How to delete user accounts via API without IP blocking

SSO
1

We have integrated Discourse with another app, and users are managed in Keycloak. When a user deletes his account in the other app, we also delete it via API in Discourse.
Works fine, but the user’s IP is then blocked automatically in Discourse, so there is no way to log in as a different user from the same IP.
Can this IP blocking be turned off? Or make it automatically unblock after some time?

2

Yes. You’ll need to in-check the thing that blocks the ip. See Reverse engineer the Discourse API and see what happens when you do it from the UX.

3

According to the API documentation for deleting a user, whether it blocks the IP is one of the options passed in with the body of the request.

So in the code where the request is being made, you should be able to provide json in the body of the request which includes ”block_ip”: false.

For example:

{
  delete_posts: false,
  block_email: false,
  block_urls: false,
  block_ip: false,
}
3 Likes
4

I’m not sure if I understand this.
Do you mean I have to unblock the IP via API after the account has been deleted?

I was actually hoping for some configuration switch in Discourse.

5

Ah, got it. Thanks, will try this.

2 Likes
6

Hey
Have you gotten your answer here? as ”block_ip”: false, doesn’t work in API request body in my case, so did you have it work or you happen to send another separate request by reverse engineering Discourse API?

7

It does work for me.
This is our request body:

{
  delete_posts: false,
  block_email: false,
  block_urls: false,
  block_ip: false,
}
2 Likes
8

I wonder if the problem was using "block_ip": false exactly for the request body, as opposed to a JSON object string. I can no longer edit my post but I’ve flagged it to have your JSON added as an example to hopefully make the marked solution clearer.

9

Thanks for your reply.
We have this in place for the request JSON body {block_email: false} (It’s block_email in our situation), but it doesn’t seem to take effect in user deletion API. We needed to send a separate request to remove the email from the Screened Emails (Blocking Emails).

10

Depending on the way you construct your JSON-String (manually or with a library) you might need try single quotes, double quotes, no quotes at all. Besides that I have no idea - the Discourse API usually does exactly what it promises.

1 Like
11

Okay, I will post it here for anyone who comes to the same situation with the user deletion API.
block_ip: False does reliably prevents the IP from being added to screened IPs.
block_email: False should prevent the email from being added to screened_emails, However some edge cases (like spam-flagged users or TL0 new users) may still trigger email screening even if block_email is False.
This will need an extra request to unblock the email from Screened Emails.