# Oauth2 plugin sso, how to switch off email verification
**URL:** https://meta.discourse.org/t/oauth2-plugin-sso-how-to-switch-off-email-verification/87542
**Category:** SSO
**Created:** [May 15, 2018, 4:32pm UTC](https://meta.discourse.org/t/oauth2-plugin-sso-how-to-switch-off-email-verification/87542 "2018-05-15T16:32:38Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@shahidmir](https://meta.discourse.org/u/shahidmir)
#### Post date: [May 15, 2018, 4:32pm UTC](https://meta.discourse.org/t/oauth2-plugin-sso-how-to-switch-off-email-verification/87542/1 "2018-05-15T16:32:38Z")
Hi guys,
For about 4 weeks or longer I have been working on SSO between Auth0 and discourse, on and off. I have gone for different solutions and had to change my approach a few times. I am now at a point where I need further advice.
1- I started by using the SSO approach mentioned in this article:
[https://blog.leog.me/discourse-sso-with-auth0-e49486d0294a](https://blog.leog.me/discourse-sso-with-auth0-e49486d0294a)
Recently it has come to light that the redirect approach mentioned in this article (redirecting from auth0 rule to discourse via the SSO login url) results in an incomplete login on Auth0 end, hence a customer login is not registered, which impacts the SSO cookie etc on Auth0 side. So we have to move away from this approach.
2- I have now deployed the 0auth2 plugin and am using the approach specified below:
> [@Configure sign up and log in with Auth0 using the OAuth2 Basic Plugin](https://meta.discourse.org/t/how-to-use-auth0-with-the-oauth2-basic-plugin/64633):
>
> If you are using [Auth0](https://auth0.com/) as your identity provider this guide will show you how to setup authentication using the [Discourse OAuth2 Basic Plugin](https://meta.discourse.org/t/oauth2-basic-support/33879). Initial Steps Create an Auth0 account if you don’t already have one The [Discourse OAuth2 Basic Plugin](https://meta.discourse.org/t/oauth2-basic-support/33879) ships pre-installed with Discourse. If you are self-hosted, ensure the plugin is enabled. For [hosted plans](https://www.discourse.org/pricing), the plugin is available on Business tier and above. Configure Auth0 Applications → Create Application Give your client a name like “Discourse…
The issue I have now is the “requirement to verify email” before discourse creates the user record and logs the user in. Is there no way to turn this feature off via the dashboard config?
What is the best approach to work around this if the feature cant be turned off? I dont want the user to have to verify the email in discourse.
I have found a few articles but the seem overly complicated.
Regards
shahid
---
### Author:  [@blake](https://meta.discourse.org/u/blake)
#### Post date: [May 15, 2018, 4:38pm UTC](https://meta.discourse.org/t/oauth2-plugin-sso-how-to-switch-off-email-verification/87542/2 "2018-05-15T16:38:53Z")
> [@shahidmir](#):
>
> The issue I have now is the “requirement to verify email” before discourse creates the user record and logs the user in. Is there no way to turn this feature off via the dashboard config?
> What is the best approach to work around this if the feature cant be turned off? I dont want the user to have to verify the email in discourse.
There is a setting called “oauth2 email verified” that you can check. Here is the description for the setting:
> Check this if the OAuth2 site has verified the email
---
### Author:  [@shahidmir](https://meta.discourse.org/u/shahidmir)
#### Post date: [May 15, 2018, 4:42pm UTC](https://meta.discourse.org/t/oauth2-plugin-sso-how-to-switch-off-email-verification/87542/3 "2018-05-15T16:42:22Z")
hi blake,
thanks for that. I did actually switch that on, but still get the message on the login page about email being unverified?
---
### Author:  [@shahidmir](https://meta.discourse.org/u/shahidmir)
#### Post date: [May 15, 2018, 4:48pm UTC](https://meta.discourse.org/t/oauth2-plugin-sso-how-to-switch-off-email-verification/87542/4 "2018-05-15T16:48:25Z")
---
### Author:  [@blake](https://meta.discourse.org/u/blake)
#### Post date: [May 15, 2018, 4:52pm UTC](https://meta.discourse.org/t/oauth2-plugin-sso-how-to-switch-off-email-verification/87542/5 "2018-05-15T16:52:44Z")
What do you have set in the “oauth2 json email path” box?
Maybe that isn’t set correctly
---
### Author:  [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [May 15, 2018, 4:57pm UTC](https://meta.discourse.org/t/oauth2-plugin-sso-how-to-switch-off-email-verification/87542/6 "2018-05-15T16:57:19Z")
Does that assume the upstream Oauth2 IdP has verified email addresses?
---
### Author:  [@shahidmir](https://meta.discourse.org/u/shahidmir)
#### Post date: [May 15, 2018, 4:57pm UTC](https://meta.discourse.org/t/oauth2-plugin-sso-how-to-switch-off-email-verification/87542/7 "2018-05-15T16:57:38Z")
---
### Author:  [@shahidmir](https://meta.discourse.org/u/shahidmir)
#### Post date: [May 15, 2018, 4:58pm UTC](https://meta.discourse.org/t/oauth2-plugin-sso-how-to-switch-off-email-verification/87542/8 "2018-05-15T16:58:09Z")
yes thats the case i believe.
---
### Author:  [@blake](https://meta.discourse.org/u/blake)
#### Post date: [May 15, 2018, 5:02pm UTC](https://meta.discourse.org/t/oauth2-plugin-sso-how-to-switch-off-email-verification/87542/9 "2018-05-15T17:02:07Z")
Okay can you look in your logs and see if you see anything? Also could you look at one of the new users and see if they actually have an email address?
---
### Author:  [@shahidmir](https://meta.discourse.org/u/shahidmir)
#### Post date: [May 15, 2018, 5:03pm UTC](https://meta.discourse.org/t/oauth2-plugin-sso-how-to-switch-off-email-verification/87542/10 "2018-05-15T17:03:32Z")
is the user record in discourse only created after the verification? if i go in as admin, should i see the record?
---
### Author:  [@blake](https://meta.discourse.org/u/blake)
#### Post date: [May 15, 2018, 5:05pm UTC](https://meta.discourse.org/t/oauth2-plugin-sso-how-to-switch-off-email-verification/87542/11 "2018-05-15T17:05:35Z")
They should be in there before verification. You may need to click on the new tab and/or sort by created date `/admin/users/list/new?order=created`
---
### Author:  [@shahidmir](https://meta.discourse.org/u/shahidmir)
#### Post date: [May 15, 2018, 5:07pm UTC](https://meta.discourse.org/t/oauth2-plugin-sso-how-to-switch-off-email-verification/87542/12 "2018-05-15T17:07:54Z")
interesting… as the users are not there
---
### Author:  [@blake](https://meta.discourse.org/u/blake)
#### Post date: [May 15, 2018, 5:09pm UTC](https://meta.discourse.org/t/oauth2-plugin-sso-how-to-switch-off-email-verification/87542/13 "2018-05-15T17:09:50Z")
hmm okay. See what you can find in `/logs`. I’m not really sure what is going on. I’ll have to login into my auth0 account and see if I can get it working again and see if I run into a similar issue.
---
### Author:  [@shahidmir](https://meta.discourse.org/u/shahidmir)
#### Post date: [May 15, 2018, 5:10pm UTC](https://meta.discourse.org/t/oauth2-plugin-sso-how-to-switch-off-email-verification/87542/14 "2018-05-15T17:10:52Z")
thanks, will check the logs and update.
---
### Author:  [@shahidmir](https://meta.discourse.org/u/shahidmir)
#### Post date: [May 15, 2018, 5:56pm UTC](https://meta.discourse.org/t/oauth2-plugin-sso-how-to-switch-off-email-verification/87542/15 "2018-05-15T17:56:49Z")
Hi
taking a look at the logs below, does it seem as if the json call to the authentication provider for user info is not returning anything?
```
(oauth2_basic) Callback phase initiated.
Processing by Users::OmniauthCallbacksController#complete as HTML
Parameters: {"code"=>"P-xxxxxxxxx-4", "state"=>"b65xxxxxxxxxaa
5769cxxxxxxx9", "provider"=>"oauth2_basic"}
OAuth2 Debugging: after_authenticate response:
creds: {"token"=>"wPxxxxxxxxxxxxwq7", "expires_at"=>1526490618, ""
expires"=>true}
info: {"id"=>nil, "name"=>nil}
extra: {}
OAuth2 Debugging: user_json_url: GET https://xxxxxxxxx/userinfo
OAuth2 Debugging: user_json: {}
Rendering users/omniauth_callbacks/complete.html.erb within layouts/no_ember
Rendered users/omniauth_callbacks/complete.html.erb within layouts/no_ember (00
.5ms)
Rendered layouts/_head.html.erb (0.2ms)
Rendered common/_special_font_face.html.erb (0.2ms)
Rendered common/_discourse_stylesheet.html.erb (0.1ms)
Rendered application/_header.html.erb (0.1ms)
Completed 200 OK in 201ms (Views: 2.3ms | ActiveRecord: 11.1ms)
Started GET "/discussion/srv/status" for 127.0.0.1 at 2018-05-15 17:10:23 +0000
```
---
### Author:  [@blake](https://meta.discourse.org/u/blake)
#### Post date: [May 15, 2018, 5:59pm UTC](https://meta.discourse.org/t/oauth2-plugin-sso-how-to-switch-off-email-verification/87542/16 "2018-05-15T17:59:59Z")
Yes, it doesn’t look like it is returning anything since user\_json is empty
---
### Author:  [@blake](https://meta.discourse.org/u/blake)
#### Post date: [May 16, 2018, 1:23am UTC](https://meta.discourse.org/t/oauth2-plugin-sso-how-to-switch-off-email-verification/87542/17 "2018-05-16T01:23:21Z")
Okay I figured out a couple of the issues and one of them may require a code fix. I’ll post my findings tomorrow.
---
### Author:  [@shahidmir](https://meta.discourse.org/u/shahidmir)
#### Post date: [May 16, 2018, 8:12am UTC](https://meta.discourse.org/t/oauth2-plugin-sso-how-to-switch-off-email-verification/87542/18 "2018-05-16T08:12:48Z")
hi blake,
so that i dont misunderstand, are you saying this will not work until a fix is made on your side?
regards
shahid
---
### Author:  [@shahidmir](https://meta.discourse.org/u/shahidmir)
#### Post date: [May 16, 2018, 8:56am UTC](https://meta.discourse.org/t/oauth2-plugin-sso-how-to-switch-off-email-verification/87542/19 "2018-05-16T08:56:22Z")
strangely, when the auth0 lock widget pops up through oauth2 login, when i enter the username/password a fresh, i get valid json back. But if i click on the username that it already remembers (so not re-entering username/password) it gives me blank json.
---
### Author:  [@shahidmir](https://meta.discourse.org/u/shahidmir)
#### Post date: [May 16, 2018, 10:43am UTC](https://meta.discourse.org/t/oauth2-plugin-sso-how-to-switch-off-email-verification/87542/20 "2018-05-16T10:43:06Z")
hi blake, i have this working now, just need to figure out the silent auth bit (when auth lock widget comes up remembering previously used login), which i think is calling the authentication provider without the necessary scopes for the end point…
I have another issue though. The userId that is coming back from the userInfo json endpoint is a url namespace e.g. [https://domain.user.id](https://domain.user.id).
In the oauth2 plugin config i am specifying this domain as the userId field, but i think instead of taking that field from the json it seems to be trying to find “.id” at the “[https://domain](https://domain)” → “user” → “id” node.
How do i get around this issue?
regards
[Next page](https://meta.discourse.org/t/oauth2-plugin-sso-how-to-switch-off-email-verification/87542.md?page=2)