Generic “userN” usernames

[kevinherron]

Was there a recent change that is leading to the influx of generic users named “userN” (where N is some number) on our Discourse instance and if so it possible to disable this? I haven’t been able to find anything in the settings.

[anon73664359]

Those accounts might’ve been anonymized at some point in time.

Anonymizing Users in Discourse

If you want to permanently remove a user from your community, but also preserve their contributions to Discourse, you can anonymize that user. How do I anonymize a user? At the bottom of a user’s admin page, there is an “Anonymize User” button: [image] You’ll be asked to confirm. If you agree, the user will be anonymized. How thorough is the anonymization? The user will no longer be able to log in to your community as this specific account. A new username will be randomly assigned to t…

[kevinherron]

They’re all new users asking their first question, I don’t think they’ve been anonymized by an admin.

Edit: or just new users, not necessarily with a post.

[JammyDodger]

What method are these new users using to sign-up?

[kevinherron]

I’m not sure, is there somewhere I can check that?

It seems all these users have empty username details in the DiscourseConnect SSO section at the bottom of the User Admin page, if that means anything.

[Johani (Joe)]

Do you have groups with the same names?

This sounds similar to

Username changed after Discourse upgrade

There is likely a group with the name martin. Users and groups cannot share the same name. There was previously a bug which allowed this to happen, but it has now been fixed - that’s why your username has been changed automatically. We should probably update the error message here to make it clear that a username must not match any group names. Added to my list to investigate

[kevinherron]

There is no group called “user”.

[JammyDodger]

@kevinherron

It seems all these users have empty username details in the DiscourseConnect SSO section at the bottom of the User Admin page, if that means anything.

Can you check your discourse connect sign-up and see if the username field can be skipped when registering?

[kevinherron]

I’ll have to check with the internal systems team that manages our global user accounts and I assume the integration with Discourse Connect SSO. I suspect the issue is somewhere in here… just not sure why the sudden behavior change. I don’t think our global accounts have usernames, just emails, but this issue seems to have just popped up.

Anyway it’ll be a few hours before anybody is actually online. I’m up waaaay early.

[gerhard (Gerhard Schlager)]

We recently stopped using email addresses when generating usernames during SSO.

FEATURE: stop using email as source for username and name suggestions for Single Sign On (#14541)

The recommended solution is to supply a username in the SSO payload. You can go back to the previous behaviour by changing a hidden site setting, but we might remove it in the future.

./launcher enter app
rails c
SiteSetting.use_email_for_username_and_name_suggestions = true

[kevinherron]

So if our user accounts don’t have usernames and we just supply the email address in the username field of the SSO payload it will behave as it did previously?

[andrei (Andrei Prigorshnev)]

@kevinherron

So if our user accounts don’t have usernames and we just supply the email address in the username field of the SSO payload it will behave as it did previously?

Yes, that should work. But it’s better to avoid generating usernames from emails because in this case, it’s easy to figure out emails of your users. This is insecure.

Note, that you can also send a full name in the name field to SSO. If you do so:

• name will become the full name of a user on your Discourse
• name will be used by SSO for generating username

[kevinherron]

Thanks everybody, I think we’ve got all the info we need to work around this in the short term and fix in the long term.