Disable account confirm emails when creating users via API

@team

Continuing the discussion from Disable Welcome Emails - Can it be done?:

Hello. I’ve tried disabling these in a bunch of ways:

I’ve tried both choices for “discourse narrative bot welcome post type”, and the email sends no matter what.

I’ve also tried doing this:

The email is still being sent. How do I stop it?

Having a similar problem with the “Confirm your new account” email – the PM from discobot is turned off, but users are still receiving the email. It looks like these are different settings. Is there a way to remove the confirmation email?

For clarification, are you adding users via the API @jeffbrowning?

Correct. This is an API call. The data is:

data = {
        'api_key': settings.DISCOURSE_API_KEY,
        'api_username': settings.DISCOURSE_API_USERNAME,
        'name': 'foobar',
        'email':email,
        'password': password,
        'username': 'barbaz',
        'active': True,
        'approved': True
    }

I first tried just sending this API call:
first_res = requests.post('{base}/users.json'.format(base=settings.DISCOURSE_BASE_URL), data

When I did this, my users were not active (despite the active: True in the data above).
I then tried to activate them via the api:

data = {
        'api_key': settings.DISCOURSE_API_KEY,
        'api_username': settings.DISCOURSE_API_USERNAME,
    }
    requests.put('{base}/admin/users/{id}/activate'.format(
        base=settings.DISCOURSE_BASE_URL,
        id=json_response_content['user_id']
    ), data)

When I did this, the users were active, but the activation email was still being sent. I read here (Creating Active Users via the API gem - #3 by MikeTaber) That I should try deactivating the user and then activating, so I tried that as well:

data = {
        'api_key': settings.DISCOURSE_API_KEY,
        'api_username': settings.DISCOURSE_API_USERNAME,
    }
    requests.put('{base}/admin/users/{id}/deactivate'.format(
        base=settings.DISCOURSE_BASE_URL,
        id=json_response_content['user_id']
    ), data)
    requests.put('{base}/admin/users/{id}/activate'.format(
        base=settings.DISCOURSE_BASE_URL,
        id=json_response_content['user_id']
    ), data)

I could not see any difference in behavior between this code and the previous version (creating the user, and then activating).

Per:

https://github.com/discourse/discourse/commit/9f0f086b3e117a799ba3277dcbdda8781c55842e

You can now specify that an account is also approved on creation, previously it was beyond cumbersome.

You should use active: 'true' , upper case true will not work.

As long as the API key is associated with an admin you can now create approved, active accounts via the API with no emails.

We will deploy this to our standard tier later this week.

Ok we’ll try that. Do we still need to deactivate + activate or can we take that out as well?

Take that out, but wait till Friday or so to test this out, we have a process prior to pushing our standard tier that we need to follow.

Is there a security risk here? Can we stipulate these cannot be staff (mod/admin) accounts?

It should be fine, we only whitelist staged, approved and active. Admin/moderator is not in the whitelist

I am still having issues creating user accounts using the API. Here are the params I am passing to create the user

$params = array(
            'name'                  => $user_details['name'],
            'username'              => $user_details['username'],
            'email'                 => $user_details['email'],
            'password'              => $user_details['password'],
            'challenge'             => $api_keys->challenge,
            'password_confirmation' => $api_keys->value,
            'active' => 'true',
            'approved' => 'true',
            );

The user is being successfully create and no email is being sent. But when I try to login using the account created I am getting the following error message.
You can’t log in yet. We previously sent an activation email to you at *@.org. Please follow the instructions in that email to activate your account. Do I have to change any other settings on the admin? Any help is appreciated.

You might try activating the user with a second API call.

@pfaffman The issue that I am facing with that approach is, a confirmation email gets sent out when I create the user without the “active” parameter. Ideally I would want to create and activate an user using the api without sending the confirmation email.

So my idea was to create the user that way and then try to activate the user via a second API call.

Usually the answer to questions like this are to use SSO, but it’s not clear that it’s what you should do.

Unfortunately we cant use SSO.
The issue with creating an user by passing the active flag and then trying to activate is that we cant activate an already activated user.
I was hoping when active =“true” is passed as a parameter to create the user the user account should be created and activated without sending the confirmation email. Looks like the API request is not doing that.

That sounds like a bug to me.

My next suggestion would be to create it with active. Then deactivate and reactivate with the API. (Or to submit a PR that fixes the bug.)

Yes, Looks like this is the only method that works. Thanks.

이게 아예 동작하지 않는 건가요?

비활성화와 활성화도 제대로 작동하지 않는 것 같습니다. 아직 활성화되지 않은 사용자에게 이메일이 계속 발송되고 있는 것을 확인했습니다.

active=true와 approved=true를 설정하여 API 호출을 시도해 보았지만, 다음과 같은 응답을 받았습니다:

{
“success”: true,
“active”: false,
“message”: “거의 완료되었습니다! ‘[내 이메일]’로 활성화 메일을 보냈습니다. 계정을 활성화하려면 메일의 지시를 따르세요. 메일이 도착하지 않으면 스팸 폴더를 확인해 주세요.”
}

그러나 이메일은 발송되지 않았고, 사용자로 보이는 것도 생성되지 않았습니다. 적어도 관리자 인터페이스에서는 아무것도 보이지 않습니다. 그 이유는 무엇일 수 있을까요?

사용자가 “active” 탭 대신 “new” 탭에 있을 수도 있습니다?

API를 통해 사용자를 생성하려는 구체적인 사용 사례가 정확히 무엇인지 확실하지는 않지만, Single Sign on을 사용하는 방안을 검토해 보시는 것을 추천합니다.

다만, 확인 이메일을 보내지 않고 API를 통해 사용자를 생성하려면 현재 다음과 같은 3개의 요청을 수행해야 합니다:

  1. active=true 파라미터로 사용자를 생성합니다.
  2. 사용자를 비활성화합니다.
  3. 사용자를 활성화합니다.

Blake님, 답변해 주셔서 감사합니다!

아니요, 안타깝게도 아닙니다. 확인해 봤는데, 어떤 이유에서인지 “Active” 탭과 “New” 탭에 동일한 사용자 목록이 표시되고 있습니다. 단지 순서만 다릅니다.

저는 다른 플랫폼(이슈 트래커인 YouTrack)에서 이주할 계획이며, 사용자에게 최대한 부드럽고 매끄러운 경험을 제공하고자 합니다. 따라서 제 계획은 API를 통해 모든 사용자를 먼저 이동한 다음, 그들의 게시물(이슈 트래커에서 가져와서 API를 통해 Discourse에 생성), 댓글 및 첨부 파일을 이동하고, 그 후에 초대장을 보내는 것입니다. 이것이 제가 먼저 사용자를 생성해야 하는 이유입니다 - 그들이 자신의 게시물과 댓글의 작성자로 표시되도록 하기 위해서입니다.

네, 이 토픽 위에서 그 내용을 읽었습니다. 문제는 2단계에서 사용자 ID를 알아야 하는데, 그것은 1단계의 응답에 포함되어 있어야 하지만 실제로는 포함되지 않았습니다. 또한, 여기에서 보여준 것처럼 "active=true"에 대한 응답 메시지는 달라야 합니다: Creating Active Users via the API gem - #36 by mikechristopher