# SSO and changing email addresses upstream

**URL:** https://meta.discourse.org/t/sso-and-changing-email-addresses-upstream/96116
**Category:** Support
**Created:** [August 31, 2018, 8:21pm UTC](https://meta.discourse.org/t/sso-and-changing-email-addresses-upstream/96116 "2018-08-31T20:21:15Z")
**Posts on this page:** 1
**Showing post:** 3

<div class="post-metadata">

### Author: ![sudoman](https://avatars.discourse-cdn.com/v4/letter/s/8baadc/32.png) [@sudoman](https://meta.discourse.org/u/sudoman)
#### Post date: [August 31, 2018, 9:04pm UTC](https://meta.discourse.org/t/sso-and-changing-email-addresses-upstream/96116/3 "2018-08-31T21:04:08Z")

</div>

@simon Thank you so much for clarifying my confusion! 😀 Thankfully, it sounds like that would work with our setup.

Is it dangerous to enable email address overrides if the email addresses are not validated by our authentication server? Would that incur the issue mentioned here:

> [@Setup DiscourseConnect - Official Single-Sign-On for Discourse (sso)](https://meta.discourse.org/t/setup-discourseconnect-official-single-sign-on-for-discourse-sso/13045/1):
>
> ⚠ Discourse uses emails to map external users to Discourse users, and assumes that external emails are secure. **IF YOU DO NOT VALIDATE EMAIL ADDRESSES BEFORE SENDING THEM TO DISCOURSE, YOUR SITE WILL BE EXTREMELY VULNERABLE!**

I don’t know much about how the [Discourse SSO](https://meta.discourse.org/t/13045?silent=true) integration works, but I wonder whether if there are problems beyond password reset issues if someone supplies an invalid email address to the site, either when first creating an account via SSO or later on.

Either way, it seems like validating email addresses upon first login and not overriding email addresses from the SSO server would be a safe way to go.

Thanks so much for your clarification. 😀

---

_[View the full topic](https://meta.discourse.org/t/sso-and-changing-email-addresses-upstream/96116)._