Repository navigation
Replies: 1 comment
|
Here's the demo about the situation I mention above: Screen.Recording.2026-10-08.at.15.35.29.mov |
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
What happens today
The server admin guide describes the Verify Email required action as: "The user must verify their email account. An email will be sent to the user with a validation link that they must click."
When an administrator adds Verify Email to a user whose email is already marked as verified, in the Admin Console (Users > user > Details > Required user actions) or through
PUT /admin/realms/{realm}/users/{id}, no email is sent. At the next login the action is marked as completed and removed (CUSTOM_REQUIRED_ACTIONevent, noSEND_VERIFY_EMAIL), and the user signs in without verifying anything. Until then the Admin Console shows Email verified On next to the pending Verify Email action.Reproduced on main (8d330a0) and on 26.7.5.
If the administrator also switches Email verified off in the same save, everything works: the email is sent at the next login and the flag comes back on once the link is used.
Why it happens
VerifyEmail#processcompletes the action whenemailVerifiedis alreadytrue. That check has a purpose: the user may have verified the address from another browser or tab while this authentication session was open.RequiredActionPriorityTest.skipToNextRequiredActionWithCustomPriorityalso relies on it: switching Email verified on while Verify Email is pending completes the action. Nothing resets the flag when an administrator adds the action.Proposal
When the Admin REST API update of an existing user (so also the Admin Console save) newly adds
VERIFY_EMAIL, and the action is enabled in the realm, setemailVerifiedtofalsein the same update, even if the request carriesemailVerified=trueas the Admin Console form does.Unchanged by this:
VerifyEmail(the action token handler removes the action from the user);VERIFY_EMAIL, and execute-actions emails.I have a prototype in
UserResource.updateUserFromRepwith tests in the new test framework (UserRequiredActionsTest), plus a note for the admin guide and the 27.0.0 upgrading guide. With it, the same flow sends the verification email at the next login, and Email verified is back on once the link is used.Alternatives I considered
VerifyEmailso it always sends the email while the action is on the user. This changes the tested behaviour above, and could ask users again when an identity provider has just marked the email as verified.Questions
If the direction works for you, I can open an issue and a PR with the prototype.
All reactions