Unverified emails

[nawaf-alnaji]

Regarding the discoverer blocking unverified emails, I had a couple of questions.

Currently the flow blocks accounts with unverified emails, but not nonexistent accounts. This presents a workaround where a user can enter "[email protected]", and that will redirect them and allow them to login through the IdP, and even connect their IdP profile to any existing account with the same email.

I'm wondering what's the reasoning for blocking unverified emails, and whether there's a config-side workaround to allow them.

If not, what do you think about it becoming a config property?

[sventorben]

Does this help? --> #35 (comment)

[nawaf-alnaji]

It does not. This approach works for nonexistent users, not users with unverified emails. A user with unverified email will be blocked from being redirected. The workaround for that is to enter a nonexistent gibberish email, then when redirected to the Idp login with the correct email. Once that is done, the email will become verified and the redirection will work on subsequent logins.

What's the reasoning for this design?

[sventorben]

The reason for this design is to support other use cases.
Consider for example scenarios where login with email address is not allowed and users have to use their username. In these cases users cannot enter a gibberish email. User will never be redirected if their email is not verified. There are some production scenarios using this feature.

I filed a feature request to enable forwarding users with unverified email addresses: #261