prevent changing a provisioned user's password

server/server_account.go

@@ -208,6 +208,9 @@ func (s *Server) handleAccountPasswordChange(w http.ResponseWriter, r *http.Requ
 	}
 	logvr(v, r).Tag(tagAccount).Debug("Changing password for user %s", u.Name)
 	if err := s.userManager.ChangePassword(u.Name, req.NewPassword, false); err != nil {
+		if errors.Is(err, user.ErrProvisionedUserPasswordChange) {
+			return errHTTPConflictProvisionedUserPasswordChange
+		}
 		return err
 	}
 	return s.writeJSON(w, newSuccessResponse())