Currently, the Exchange tab within the built-in AD connector in HelloID Provisioning automatically saves changes immediately after fields are modified. While convenient in some cases, this behavior can unintentionally overwrite existing credentials.
In practice, this has caused multiple incidents where browser autofill tools such as LastPass automatically populated credential fields, resulting in the configured Exchange credentials being overwritten without the administrator noticing it immediately. We have also seen cases where customers reported that the connector stopped working, while the root cause turned out to be unintentionally changed credentials.
Because changes are applied instantly, there is currently no safeguard or confirmation step before critical configuration values are stored.
Proposal:
- Replace Autosave with Explicit Save/Apply Action
Introduce an Apply or Save button for the Exchange configuration tab so changes are only persisted after explicit user confirmation.
- Optional Confirmation for Credential Changes
Consider prompting users with a confirmation dialog when sensitive fields such as usernames or passwords are modified.
- Prevent Browser Autofill Issues
Evaluate whether credential fields can better prevent unintended autofill behavior from password managers and browsers.
Benefits:
- Reduced Risk of Accidental Misconfiguration
Prevents credentials from being overwritten unintentionally by browser autofill tools or accidental edits.
- Improved Stability and Reliability
Reduces incidents where connectors unexpectedly stop functioning due to unnoticed credential changes.
- Better Administrative Control
Gives administrators explicit control over when configuration changes are committed.
- Improved Troubleshooting Experience
Makes configuration changes more deliberate and traceable, reducing confusion during support and implementation activities.