The discussion is about allowing users to log in to a Discourse forum exclusively via Single Sign-On (SSO) without requiring an email address. Some users may have a verified email address, while others may not. The proposed solution is to create a fake email address for users without an email address, solely to satisfy Discourse’s internal requirements.
(icaria36)[/t/-/236747/1] explains that this is a continuation of a previous discussion about allowing users to register without an email address. Simon Cossar suggested authenticating users through another website that uses two-factor authentication and generating an email address for them if needed.
(icaria36)[/t/-/236747/1] asks if this scenario is technically feasible, and (pfaffman)[/t/-/236747/3] suggests that it might work by sending a fake email address with an invalid top-level domain (TLD) that would be ignored by email providers. However, (pfaffman)[/t/-/236747/6] later clarifies that this is just a theory and has not been tested.
(angus)[/t/-/236747/5] notes that the scope of this discussion is limited to users who log in exclusively via SSO and that the solution would require disabling email for those users. (pfaffman)[/t/-/236747/6] agrees that a custom plugin or user field would be needed to skip sending emails to users with an invalid TLD.
The discussion is ongoing, with the goal of finding a solution that allows users to join the forum without an email address, while also ensuring the safety and anonymity of users who require it.
Users log in to the forum exclusively via SSO. Given that email is not required in our parent project, some users may have a verified email, some may not. We trust these users in the forum as much as we trust them in our parent website.
When a user without and email address logs for the first time, a fake email address is created only to satisfy Discourse’s internal requirements for user IDs.
These users won’t receive any emails, they are aware, and they are happy with the trade-off. If anyone wants email notifications, they will have to create an email account somewhere they trust.
Context: for safety reasons, in Wikimedia many users have good reasons to remain anonymous editors cutting also a connection to an email address. This is why many Wikipedia etc editors have an account without an email address attached to it. We want to give them the same opportunity to join the discussions in our forum. Several users have asked (in other places or to us personally).
Yes. I think that should work. In fact, I think you could just have your system send username@whatever.invalid as the email address and it would just work, as I think everything knows to ignore the invalid tld.
I’m curious, have you used this successfully in the wild (genuine question)? What do the logs (of both the discourse and mail provider) of such an instance look like?
p.s. Anyone reading this hoping to get rid of the need for emails please note that the scope here is “Users log in to the forum exclusively via SSO”.
Ha. No. I didn’t mean to suggest that this worked, was a good idea, or wouldn’t kill your dog. I don’t know what will actually happen if your try this.
It just seems like it should work. if you really want this and have time for some testing, it just might work.
Yes, it counts on sso, and on sso lying that email has been validated.
It would be best if something were done to disable email for those users, and I don’t know for sure what happens when your mailer gets a invalid tld. If it retries them then you’d need something like a plugin that would somehow skip sending those emails with an invalid tld, or a custom user field to completely disable email, which would be a good idea anyway.
