diff --git a/src/routes/test/users-test.js b/src/routes/test/users-test.js
index 906ba9c2a..8db872690 100644
--- a/src/routes/test/users-test.js
+++ b/src/routes/test/users-test.js
@@ -211,6 +211,39 @@ describe('Users API', function () {
         });
     });
 
+    describe('make local', function () {
+        let userId;
+
+        before(async function () {
+            const response = await superagent.post(`${serverUrl}/api/v1/users`)
+                .query({ access_token: owner.token })
+                .send({ username: 'ldapuser', email: 'ldapuser@example.com' });
+
+            expect(response.statusCode).to.equal(201);
+
+            userId = response.body.id;
+        });
+
+        it('cannot make a local user local', async function () {
+            const response = await superagent.post(`${serverUrl}/api/v1/users/${userId}/make_local`)
+                .query({ access_token: owner.token })
+                .send({})
+                .ok(() => true);
+
+            expect(response.statusCode).to.equal(409);
+        });
+
+        it('succeeds', async function () {
+            await users.update({ id: userId }, { source: 'ldap' }, {});
+
+            const response = await superagent.post(`${serverUrl}/api/v1/users/${userId}/make_local`)
+                .query({ access_token: owner.token })
+                .send({});
+
+            expect(response.statusCode).to.equal(204);
+        });
+    });
+
     describe('admin status', function () {
         it('set second user as admin succeeds', async function () {
             const response = await superagent.post(`${serverUrl}/api/v1/users/${user.id}`)
diff --git a/src/routes/users.js b/src/routes/users.js
index 9c15d1e00..d595e62dc 100644
--- a/src/routes/users.js
+++ b/src/routes/users.js
@@ -221,6 +221,8 @@ async function makeLocal(req, res, next) {
 
     if (users.compareRoles(req.user.role, req.resource.role) < 0) return next(new HttpError(403, `role '${req.resource.role}' is required but user has only '${req.user.role}'`));
 
+    if (req.resource.source === '') return next(new HttpError(409, 'user is already local'));
+
     let [error] = await safe(users.update(req.resource, { source: '', inviteToken: '' }, AuditSource.fromRequest(req)));
     if (error) return next(BoxError.toHttpError(error));