Make requirement for verified email optional

element-hq / matrix-authentication-service

GNU Affero General Public License v3.0

10 stars 1 forks source link

Make requirement for verified email optional #1505

Open matrixbot opened 1 week ago

matrixbot commented 1 week ago

This issue was originally created by @hughns at https://github.com/matrix-org/matrix-authentication-service/issues/1505.

Currently all users are required to have a verified email address. This should be configurable in future.

matrixbot commented 1 week ago

This comment was originally posted by @sandhose at https://github.com/matrix-org/matrix-authentication-service/issues/1505#issuecomment-1700698155.

It turns out, it only really was an issue because I forgot to mark the imported email as the primary email when doing an upstream oauth registration. This is fixed as part of #1660, which also introduces a new claim import parameter for the email, set_email_verification:

never: do not set the imported email as verified
always: always set the imported email as verified
import: mark the email as verified if the OAuth upstream set the email_verified claim to true (<- this is the default behaviour)

matrixbot commented 1 week ago

This comment was originally posted by @dklimpel at https://github.com/matrix-org/matrix-authentication-service/issues/1505#issuecomment-1879795694.

How can I register a local user without verify the email?

register via REST
verfify via CLI

I am not able to automate this. Either CLI or REST, but both is not possible.

set_email_verification seems only to work for an upstream provider.

matrixbot commented 1 week ago

This comment was originally posted by @sandhose at https://github.com/matrix-org/matrix-authentication-service/issues/1505#issuecomment-2295985771.

There are a few ways to work around this:

when registering the user through the CLI (mas-cli manage register-user), adding an email with the -e/--email flag should make it verified
if the email was added but not verified, it can be verified through the CLI: mas-cli manage verify-email <USERNAME> <EMAIL>
the new Admin API doesn't yet support managing user emails, so that should be added and tracked in a new issue (or at least in #3057)
the old GraphQL API has mutations to add emails and verify them, if you want to dig there