How to Disable Required SSO Email Activation

Support SSO

AI-generated summary

Disabling Required SSO Email Activation

billmaya has enabled single-sign-on (SSO) authentication for existing account credentials on their site, but wants to know if it’s possible to disable the required email activation after a successful SSO authentication. They found that setting the require_activation SSO parameter to false might disable email activation.

david confirmed that setting require_activation to false will indeed disable email activation, but it requires changes to the SSO authentication code. He also warned that this change should only be made if the provider is verifying user emails beforehand to avoid security issues.

billmaya thanked david and confirmed that their main site accounts verify user-provided emails upon creation.

1

Followed the instructions outlined here to enable single-sign-on (SSO) authentication for Discourse existing account credentials on our site.

As part of SSO authentication the user must activate their account by clicking a link sent in an email to their email address.

Here is what appears on the forum after you have authenticated but not activated your account.

image
image1150×301 25.1 KB

Here is the activation email that is sent to the user.

image
image879×305 63.3 KB

Here is my question—Is there a way to disable this required email activation after a successful SSO authentication?

I have read here that by setting the require_activation SSO parameter to false I can disable the user having to activate their account via email.

  • Will setting this SSO parameter to false disable email activation?
  • I assume this modification require changes to the SSO authentication code. Is this a correct assumption?
  • Is there any way to disable email activation via Admin settings, without requiring code changes? Note: We do not want to disable all emails being sent by Discourse, only the email related to account activation

Thanks in advance.

2

Yes and yes :+1:

No, you’ll need to update your DiscourseConnect (formerly ‘Discourse SSO’) provider code.

Please make sure that your provider is indeed verifying user emails before making this change. Otherwise, you could be open to various security issues.

3

David - Thanks for the quick answer. Yes, we are verifying user provided emails when our main site accounts are created.