Hey, I’ve set up discourse to use Auth0 as the SSO provider. The problem I have is that when a user registers they are recieving two verification emails. One from auth0 and one from discourse. Is there anyway to disable the one from discourse? Thanks in advance

[image] mat-mcloughlin: The problem I have is that when a user registers they are recieving two verification emails. One from auth0 and one from discourse. If email addresses are being verified by Auth0, you can disable Discourse verification emails by selecting the oauth2 email verified site setting. There is a reference to that setting in this post: Configure sign up and log in with Auth0 using the OAuth2 Basic Plugin - #33 by blake.

[image] mat-mcloughlin: I’ve set up discourse to use Auth0 as the SSO provider. [image] mat-mcloughlin: but I’m using SSO not Oauth2 The term SSO gets used for a few different authentication methods. This has caused confusion a few times in the past. If you are using the Discourse implementation of SSO, then email verification is controlled by the require_activation SSO parameter. Set that parameter to "false" to bypass email verification.

Thanks again @simon I want to avoid disabling it completely. At the moment I have it set up so that require_activation returns true false based upon whether they have been verified by auth0. This works fine and after they have clicked on the auth0 email the next time they login they get verified on discourse. So ideally it would just be suppressing the email unless I’m missing something

[image] mat-mcloughlin: At the moment I have it set up so that require_activation returns true false based upon whether they have been verified by auth0. That makes sense. Our WordPress plugin handles email verification in the same way. If you want to see how the require_activation value is used by Discourse, have a look at this file: https://github.com/discourse/discourse/blob/master/app/models/discourse_single_sign_on.rb#L81. You’ll see that when require_activation is set to "false" when a user is first created via SSO, an active user will be created by Discourse. If it is set to "true", the user will not be activated until they click the link in the Discourse activation email. Once a user is set to active on Discourse, the only thing that should cause a user to need to be reactivated is if you have enabled the sso_overrides_email site setting and the user updates their email address on your SSO provider site. When set to "true", require_activation also prevents Discourse from matching existing users to users from your external site based on their email address. This can cause issues when SSO is implemented after users have already been created on the site with username/password account creation.

Thank you that makes sense, however I’m not sure how this stops the “verify email” email from discourse getting sent? I just want the one from auth0 to be sent

To only have the verification email sent from your SSO provider site, users will need to register on that site and verify their email address before they first login to Discourse. You will then be able to set the require_activation parameter to "false" for those users. They will be created as active users on Discourse and not get sent the Discourse activation email.

This doesn’t make sense. How do I make them verify an email before the first login to Discourse? My website already takes care of email verifications, how do I disable Discourse from sending verification email, but still showing user a message that they need to authenticate?

[image] staskjs: How do I make them verify an email before the first login to Discourse? My website already takes care of email verifications, DiscourseConnect assumes that you are validating email addresses on your website. As long as you are doing that, do not set the require_activation parameter in the SSO payload. If that parameter is not in the payload, users will be logged into Discourse without an activation email being sent to them.

Yes, but then Discourse will assumes they are validated, which might be not true if user went to forum and forgot or decided not to validate an email. If website sets require_validation to true, meaning user has not yet validated their email on website, but definitely received a validation link, so no need for Discourse to send it again, but it will because of this parameter. Basically problem only arises if user goes to Discourse before validation. So right now I basically have to choose out of two options: User receives only one validation email, but will be treated by Discourse as validated, which is not ideal, because they might not finish validation. User receives two validation emails, but will be properly validated by both forum and website. This option is also not ideal, but is definitely better out of two. There is a third option: add a switch that works only if SSO is enabled, disabling verification email from Discourse (but leaving an error page that tells user that they are not verified)

Disable email verification for SSO

Product Support

mat-mcloughlin (Mathew McLoughlin) April 15, 2020, 5:37pm 3

Thanks for the answer @simon but I’m using SSO not Oauth2

Topic		Replies	Views
Oauth2 plugin sso, how to switch off email verification SSO	20	2895	May 16, 2018
Email activation when using SSO Feature sso , approval , discourseconnect	17	4043	May 20, 2015
How to Deactivate the Discourse Activation Email WordPress	12	5056	December 10, 2018
Any way to not require email verification with WP as the SSO Provider? SSO	3	1035	June 16, 2021
Trouble with wp-discourse logins WordPress	21	2747	March 30, 2019

Disable email verification for SSO

Related topics