# Email activation when using SSO
**URL:** https://meta.discourse.org/t/email-activation-when-using-sso/28861
**Category:** Feature
**Tags:** sso, approval, discourseconnect
**Created:** [May 15, 2015, 2:28pm UTC](https://meta.discourse.org/t/email-activation-when-using-sso/28861 "2015-05-15T14:28:11Z")
**Posts on this page:** 19
**Page:** 1
### Author:  [@plkap74](https://meta.discourse.org/u/plkap74)
#### Post date: [May 15, 2015, 2:28pm UTC](https://meta.discourse.org/t/email-activation-when-using-sso/28861/1 "2015-05-15T14:28:11Z")
[@sam continuing our discussion]
What do you all think about adding a switch to the SSO settings to disable the automatic “trusting” of email addresses. That is, forcing users to activate their discourse account when it is created via SSO.
Right now I think the assumption is that the email verification is done by the provider, and so it can be skipped in discourse. However, we run an ecommerce store and email validation on account creation would negatively impact conversion.
I’m going to spend a little time trying to get into the code base today, but let me know if you think this would be an acceptable addition (or if I shouldn’t bother).
---
### Author:  [@plkap74](https://meta.discourse.org/u/plkap74)
#### Post date: [May 15, 2015, 2:33pm UTC](https://meta.discourse.org/t/email-activation-when-using-sso/28861/2 "2015-05-15T14:33:42Z")
It looks like the relevant SSO code is at `discourse_single_sign_on:60-64`
```plaintext
# inside lookup_or_create_user
if sso_record && (user = sso_record.user) && !user.active
user.active = true
user.save!
(...)
end
```
Would it be as simple as adding a setting to switch the `user.active = true` line to use the `UserValidator` ?
---
### Author:  [@plkap74](https://meta.discourse.org/u/plkap74)
#### Post date: [May 15, 2015, 5:21pm UTC](https://meta.discourse.org/t/email-activation-when-using-sso/28861/3 "2015-05-15T17:21:13Z")
Submitted a PR for this: [Add SSO setting to not trust emails automatically by paulkaplan · Pull Request #3476 · discourse/discourse · GitHub](https://github.com/discourse/discourse/pull/3476)
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [May 16, 2015, 2:10am UTC](https://meta.discourse.org/t/email-activation-when-using-sso/28861/4 "2015-05-16T02:10:17Z")
We have definitely seen people get in trouble when they enable SSO but do not validate emails or have a captcha on signup.
---
### Author:  [@nahtnam](https://meta.discourse.org/u/nahtnam)
#### Post date: [May 17, 2015, 12:29am UTC](https://meta.discourse.org/t/email-activation-when-using-sso/28861/5 "2015-05-17T00:29:33Z")
I feel like everything should be handled by third party and not by discourse. It should be the third party sites job to verify the email and have spam protection, not discourse’s.
---
### Author:  [@purldator](https://meta.discourse.org/u/purldator)
#### Post date: [May 17, 2015, 6:20am UTC](https://meta.discourse.org/t/email-activation-when-using-sso/28861/6 "2015-05-17T06:20:58Z")
I disagree. A second layer of protection doesn’t hurt. This is especially true if it’s a _Human_ spammer that uses a well-known spam domain, IP, ect.
But for those who don’t want the extra barrier, a configurable option would make more sense.
> [@nahtnam](#):
>
> It should be the third party sites job to verify the email and have spam protection, not discourse’s.
Basically, I would trust someone else as far as I can throw 'em, or be able to make dummy accounts on their network.
---
### Author:  [@plkap74](https://meta.discourse.org/u/plkap74)
#### Post date: [May 17, 2015, 4:28pm UTC](https://meta.discourse.org/t/email-activation-when-using-sso/28861/7 "2015-05-17T16:28:18Z")
The problem is that the provider is not a forum, so it may have very different verification priorities. Spam is the priority for a forum, for which email verification is an appropriate solution. But other providers have different priorities (in our case, an ecommerce store).
It is more like a separation of concerns to allow Discourse to do it’s own types of verifications, without coupling itself to the third party provider.
---
### Author:  [@nahtnam](https://meta.discourse.org/u/nahtnam)
#### Post date: [May 17, 2015, 4:52pm UTC](https://meta.discourse.org/t/email-activation-when-using-sso/28861/8 "2015-05-17T16:52:58Z")
I’m fine with this idea as long as there is a way to turn it off…
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [May 17, 2015, 8:32pm UTC](https://meta.discourse.org/t/email-activation-when-using-sso/28861/9 "2015-05-17T20:32:08Z")
The problem is that we, Discourse, get blamed for a “spam” problem when the root cause is badly designed SSO from the parent site that lets poorly vetted accounts through … This has come up a few times.
---
### Author:  [@plkap74](https://meta.discourse.org/u/plkap74)
#### Post date: [May 19, 2015, 1:36pm UTC](https://meta.discourse.org/t/email-activation-when-using-sso/28861/10 "2015-05-19T13:36:42Z")
> [@codinghorror](#):
>
> the root cause is badly designed SSO from the parent site that lets poorly vetted accounts through
I really think that it isn’t “badly designed SSO”. Other applications **are not forums** and do not necessarily share the same concept of vetted accounts.
> [@nahtnam](#):
>
> I’m fine with this idea as long as there is a way to turn it off…
Yeah in my implementation there is a site setting that controls whether SSO trusts emails or not. Default would remain the same: all new accounts through SSO would be trusted.
---
### Author:  [@tobiaseigen](https://meta.discourse.org/u/tobiaseigen)
#### Post date: [May 19, 2015, 2:52pm UTC](https://meta.discourse.org/t/email-activation-when-using-sso/28861/11 "2015-05-19T14:52:29Z")
This conversation reminds me of another one - discourse is doing so much better at all of this and is getting better all the time, while other platforms (like wordpress) are not keeping with the times. So it may be worthwhile to make it easier to use discourse as the SSO source.. as part of the wp-discourse wordpress plugin, for example.
[https://meta.discourse.org/t/discourse-as-sso-source-of-authority-for-wordpress/18400](https://meta.discourse.org/t/discourse-as-sso-source-of-authority-for-wordpress/18400)
But this idea of @plkap74 is also very interesting - why not just still keep that layer of validation in discourse so when the user comes over from the other site they can be verified again. Perhaps we could then also still benefit from other discourse features that we lose with SSO, like the invites system, which I sorely miss!
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [May 19, 2015, 9:19pm UTC](https://meta.discourse.org/t/email-activation-when-using-sso/28861/12 "2015-05-19T21:19:18Z")
> [@plkap74](#):
>
> Other applications are not forums and do not necessarily share the same concept of vetted accounts.
How can you have an account without a forgot password link? And where does this forgot password resolve to, exactly? Can you explain that to me?
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [May 19, 2015, 9:43pm UTC](https://meta.discourse.org/t/email-activation-when-using-sso/28861/13 "2015-05-19T21:43:43Z")
I think that when people add credit cards it trumps email validation, when I buy plane tickets I am not held back on email validation
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [May 20, 2015, 1:32am UTC](https://meta.discourse.org/t/email-activation-when-using-sso/28861/14 "2015-05-20T01:32:20Z")
Possibly but where do you send the credit card receipt for the purchase?
---
### Author:  [@nahtnam](https://meta.discourse.org/u/nahtnam)
#### Post date: [May 20, 2015, 1:36am UTC](https://meta.discourse.org/t/email-activation-when-using-sso/28861/15 "2015-05-20T01:36:24Z")
To the email address…
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [May 20, 2015, 1:56am UTC](https://meta.discourse.org/t/email-activation-when-using-sso/28861/16 "2015-05-20T01:56:43Z")
For web merchants (for example Qantas ticketing etc.) the email is just assumed to be good. If they have issues the customer will contact them via a call with an order ref.
They avoid the activation of email so they do not slow down the purchase flow. (same as we do on [www.discourse.org/buy](http://www.discourse.org/buy))
Assume its the same issue for @plkap74 when people spend 800 bucks on [X-Carve](https://www.inventables.com/technologies/x-carve)
---
### Author:  [@plkap74](https://meta.discourse.org/u/plkap74)
#### Post date: [May 20, 2015, 3:34am UTC](https://meta.discourse.org/t/email-activation-when-using-sso/28861/17 "2015-05-20T03:34:27Z")
That is exactly right Sam.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [May 20, 2015, 3:38am UTC](https://meta.discourse.org/t/email-activation-when-using-sso/28861/18 "2015-05-20T03:38:30Z")
For the purposes of discussion, how does single credit card payment work? Does a user pay for each post and that is their “identity”?
What I am getting at is that there has to be some kind of account with a valid email to do anything beyond “buy this single item and never be seen again”. For example, collecting mileage points on that Quantas ticket you bought.
The case described only works if the customer buys once and walks away _forever_. Or buys so infrequently that they do not care. Neither of those are scenarios where Discourse would be of any use to that business whatsoever.
---
### Author:  [@chapoi](https://meta.discourse.org/u/chapoi)
#### Post date: [December 4, 2025, 11:35am UTC](https://meta.discourse.org/t/email-activation-when-using-sso/28861/19 "2025-12-04T11:35:56Z")