I'm not sure how easy this would be to implement, but a more fine-tuned approach would come in handy, I think: being able to lock mail, name and avatar independently of each other. That way, each organisation could set those up as needed.
Funny that you mentioned OIDC — that's actually how we found out: users had missing pictures in another app and weren't able to change there Avatars on their profiles.
Yes, exactly — the Lock Profile setting. We enable the lock to prevent users from changing their mail address to a private one and to guarantee a consistent naming scheme. Profile pictures are not a concern for us.
However, the description of that setting is then a bit misleading compared to the actual behaviour, since the text suggests that only mail and name are locked — which is exactly what we would want.
Hello all,
We just noticed that Users are not able to change or set there Avatar Picture when they are not allowed to change Name or Mail (restricted by the according Setting under Users). It looks like this setting restricts more then said change of Name and Mail.
As an Admin you could still change the Profilepciture, but this work arround seems not desirable to us.
