The discussion revolves around verifying users’ current ownership of their original email address to address a compliance issue. Bas wants to ensure users who leave their employer no longer have access to a Discourse install. David suggests using the “deactivate” button to force re-validation or a plugin that deactivates inactive users. However, this plugin doesn’t immediately deactivate users who leave their company. Bas considers modifying the plugin to re-authenticate all users periodically, as manually deactivating users might be too hostile. Pfaffman proposes having employers notify when a user leaves, but Bas notes this isn’t practical with over 100 employers involved.
Does anyone have an idea how we can verify that users are still in possession of their original email address?
Our usecase is that we allow access based on their employer’s domain. If people leave their employer, they will still have access to our Discourse install. This could be a compliancy issue.
Anyone have done something like this, in a user friendly fashion? The only option I have is to suspend all users, forcing a re-activation, but that seems a bit hostile.
You can use the “deactivate” button in the admin panel to force a specific user to re-validate their email address.
If you want to automate the process we have this plugin:
https://github.com/discourse/discourse-auto-deactivate
But it only deactivates ‘inactive’ users. If a user leaves the company it won’t deactivate them immediately.
How many employers are there? Could they let you know somehow?
Yeah, that’s the route I was going to take. Feels a bit hostile, but might be needed once a year or so.
Fantastic! We can modify that one re-authenticate all
More than 100, it’s not practical unfortunately.