Can I turn off staged users?

AI-generated summary

A discussion about turning off staged users in a private Discourse instance accessed via SSO from another app. ryanwanger explains that staged users cause problems when users change their email addresses in the other app but not in Discourse. He proposes turning off staged users, as there’s no benefit in his instance. codinghorror agrees, and zogstrip suggests adding a site setting to disable staged users. The question arises of what to do when an email arrives with an unknown email address, and codinghorror recommends rejecting it. zogstrip adds the enable_staged_users site setting, and ryanwanger expresses gratitude. Jared_Needell inquires about the behavior when using this feature, and zogstrip clarifies that it will send an ignore email.

When a person tries to email in a topic, and there is no user with that email address, it creates a staged user. Is there a way to turn off that feature?

It’s causing problems for us at the moment. Example: user clicks over from our app to our discourse instance and their user is created via SSO. Then later, back in our app, they change their email address…but don’t click over to discourse (so the change is not propagated). Then they email in from the new email address, and it bounces back saying they aren’t a recognized user. If the were to then try and click over from our app to Discourse, then confusion would ensue because Discourse can’t update the email address of the original (non-staged) user, because it has since been “taken” by the staged user.

At least, this is my best guess as to what is happening.

I believe that deleting the staged user, and then having the person click back into Discourse will appropriately update their original user to the new email address.

TL;DR: there is no benefit to staged users on our Discourse instance (which is private, and accessed via SSO from another app), and it can cause login/access problems in the case of an email change.

「いいね!」 11

Good idea, what do you think @zogstrip?

I’m cool with adding a site setting to disable staged users, but what should we do when an email arrives with an unknown email address?

  • Reject it?
  • Quote it?
  • Something else?

Reject seems simplest to me?

「いいね!」 2

Just added the “enable_staged_users” site setting :wink:

https://github.com/discourse/discourse/commit/39863953cde51046ce8beefcaf50b178a90888d4

「いいね!」 8

Amazing - thank you so much!!! :heart: :heart: :heart:

「いいね!」 2

Will this send a reject email if we use this feature? Or just a ignore type situation?

It will send an ignore email (defined by the email_reject_user_not_found string) :wink:

「いいね!」 2

This topic was automatically closed after 6 hours. New replies are no longer allowed.