# Restrict password reset based on user role

**URL:** <https://forum.keycloak.org/t/restrict-password-reset-based-on-user-role/23065>\
**Category:** Getting advice\
**Created:** [October 24, 2023, 5:55am UTC](https://forum.keycloak.org/t/restrict-password-reset-based-on-user-role/23065 "2023-10-24T05:55:19Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![gediminasre](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/gediminasre/32/8847_2.png) [@gediminasre](https://forum.keycloak.org/u/gediminasre)\
**Post date:** [October 24, 2023, 5:55am UTC](https://forum.keycloak.org/t/restrict-password-reset-based-on-user-role/23065/1 "2023-10-24T05:55:19Z")

</div>

Hi, how can I restrict password reset functionality based on user role. i.e. user clicks ‘Forgot password’, enter email, then I check if user has role ‘permanent-user’ and return error stating that ‘Not allowed to reset password’.  
I tried to play with ‘reset credentials’ Authentication flow. I can use ‘Conditional - user role’, but could not figure out how to set it up correctly. Or maybe it is not possible to do it with ‘reset credentials’ flow?  
If not possible with ‘reset credentials’ flow, any advice of which Service Provider Interfaces to use in order to override the default flow?