Users logging with SSO, without email address

This is a continuation of [Paid] Plugin- Allow no email address necessary on registration.

Would this scenario be technically feasible?

  • Users log in to the forum exclusively via SSO. Given that email is not required in our parent project, some users may have a verified email, some may not. We trust these users in the forum as much as we trust them in our parent website.
  • When a user without and email address logs for the first time, a fake email address is created only to satisfy Discourse’s internal requirements for user IDs.
  • These users won’t receive any emails, they are aware, and they are happy with the trade-off. If anyone wants email notifications, they will have to create an email account somewhere they trust.

Context: for safety reasons, in Wikimedia many users have good reasons to remain anonymous editors cutting also a connection to an email address. This is why many Wikipedia etc editors have an account without an email address attached to it. We want to give them the same opportunity to join the discussions in our forum. Several users have asked (in other places or to us personally).

1 Like

Yes. I think that should work. In fact, I think you could just have your system send username@whatever.invalid as the email address and it would just work, as I think everything knows to ignore the invalid tld.

3 Likes

Thank you @pfaffman, if this is a possibility, then maybe this is simpler than we thought. We are using this plugin for authentication: GitHub - paviliondev/discourse-wikimedia-auth: A Discourse plugin for authenticating with Wikimedia. Maybe the injection of the fake email address could happen there?

CC @angus just fyi. :slight_smile:

1 Like

I’m curious, have you used this successfully in the wild (genuine question)? What do the logs (of both the discourse and mail provider) of such an instance look like?

p.s. Anyone reading this hoping to get rid of the need for emails please note that the scope here is “Users log in to the forum exclusively via SSO”.

2 Likes

Ha. No. I didn’t mean to suggest that this worked, was a good idea, or wouldn’t kill your dog. I don’t know what will actually happen if your try this.

It just seems like it should work. if you really want this and have time for some testing, it just might work.

Yes, it counts on sso, and on sso lying that email has been validated.

It would be best if something were done to disable email for those users, and I don’t know for sure what happens when your mailer gets a invalid tld. If it retries them then you’d need something like a plugin that would somehow skip sending those emails with an invalid tld, or a custom user field to completely disable email, which would be a good idea anyway.

2 Likes