Repository navigation
(Optionally) defer user creation until verified #14877
Luthien-in-edhil
started this conversation in
Ideas
Replies: 1 comment
|
I am trying to leverage Keycloak for our user registration and I'm running into this difficulty as well. The out of the box registration flow is difficult to alter for a "multi-step" registration flow, e.g. collecting contact information like phone/email and verifying it before creation of a user. You end up having to re-implement a lot of the logic contained in the registration Without a more flexible in-progress registration flow approach, I share the same concern of a denial of service attack using up emails and creating a maintenance burden. |
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Related to issue 11800 (Automatically disable dormant users) and discussion #9348 (Disable inactive users after n number of days) I'd like to suggest having the option to defer creating a user account until it has been verified.
I understand that there is an overhead to keeping track of user activity and making sure accounts are not pruned without a good reason, but wouldn't it be much less complex to defer creating the account until the verification step has been completed within a configurable time slot?
Then, if the time slot passes without validating, the account never gets created in the first place.
This would stop the cluttering of unused user accounts (10% of all in our case) and block potential abuse by users blocking a given email address or username from being used to register (see also this similar discussion on Gitlab).
Alternatively, it would also be helpful if it was possible to search for non-validated users in the Admin UI and batch delete those.
It's of course possible to query the Admin Rest API for unverified users and delete the resulting users by their ID, but that's a cumbersome workflow, requiring setting up - for instance - something in Insomnia or Postman to the effect of:
Adding one button in the UI could accomplish the same thing, and make a lot of users love Keycloak even better.
All reactions