The discussion revolves around the limitations of editing user emails when email editable is off in a Discourse setup with Single Sign-On (SSO). Teafh initially inquires about changing a user’s Primary Email or adding Secondary Emails in this scenario. pfaffman suggests that the issue stems from having SSO configured, which controls the email address through the remote authentication server.
Teafh clarifies that they use SSO, but not DiscourseConnect, and expresses confusion about why emails can be edited when email editable is on, despite SSO being used. pfaffman responds, questioning the need to edit emails while having email_editable turned off.
The conversation concludes with Teafh understanding that they need to have their SSO manage email addresses and keep email editable off to prevent users from transferring accounts by editing their email. The motivation behind this is to address a situation where a user exploited the ability to add Secondary Emails to transfer accounts.
When email editable is on, an Admin can easily edit a user’s email.
However, when email editable is off, even the Admin can’t edit that from the profile settings.
So, I’m wondering if there’s a way to change user’s Primary Email or add Secondary Emails when email editable is off?
I’m pretty sure that’s because you’ve got SSO configured and the email address is controlled by your remote authentication server. Is that right?
Yes, we use SSO, but not the DiscourseConnect.
So, if this is the expected behavior, why emails can be edited when email editable is on, even we’re using SSO? Isn’t this cause confusion?
Do I understand that you are confused that when email_editable is turned off you are unable to edit emails?
It’s hard to imagine just why you want to edit emails and have edit-emails turned off, or why your SSO isn’t managing the email address. I’m not sure that I can help.
Thanks for help, now I understand I have to make the SSO managing the email address, and turn off email editable, to prevent the situation that users can transfer accounts simply by editing email 
.
Currently, some users want to add Secondary Emails, but someone used this feature to transfer accounts 
.