#email verification

1 messages · Page 1 of 1 (latest)

quaint echo
#

Hi, I'm using the email verification flow that can be download on the page. It works nice, but if anything goes wrong, it is very hard to recover for a user. For example, If the user has not activated his account, the password recover function will only show a generic error message and there is no chance to resend the activation email. It would be nice if the user would instead be send to a resend activation email page. How do I do this ?

drowsy forge
#

you can create a recovery stage that also activates them

quaint echo
#

Thanks for your reaction @drowsy forge
I have already tried something like that, but unfortunately I couldn't manage it.

First I created a Expression Policy:
if request.user.is_active == True:
return False
else:
return True

If I use this in the "Test Policy", I also get correct answer back, depending on whether the user is active or not. So I seem to address the right "field" already.

I binded this policy to my email-account-confirmation stage:

#

So my login flow looks like this:

#

When I try to login, only if the user is already activated, I end up in the EMail activation. That's why I tried to reverse the policy:

if request.user.is_active == True:
return True
else:
return False

But then I just got a login incorect message.

drowsy forge
#

You don't even need an expression to do this

#

It comes with a default flow that does email confirmation

#

That policy doesn't even make sense

#

The first policy u posted would just inactive them

#

The second one would just return what the value already is

#

So again nothing is really happening

#

You should make activating a user part of your sign up flow

#

User signs up then gets sent email if email is clicked they are logged in. You should not need a policy to double check

quaint echo
#

in my enrollment flow with email activation looks like this:

#

so if the user clicked this email, everything works as I wanted, but if he missed this email an try to login, there will be no correct error message like "please activate" your account

drowsy forge
#

Ok so why are you putting that policy in your login flow

quaint echo
#

and also no option to resend the activation email

drowsy forge
#

If the user is active they can login

quaint echo
#

yes

drowsy forge
#

If they aren't they can't you don't need an expression

drowsy forge
#

As long as your recovery flow as the make user active box checked you can just send them an email

#

To reset their password when they do the account will also be make active

#

If their email is invalid they will never get a link to confirm

#

Did you have users sign up before you had email confirmation on your enrollment flow

#

I understand your goal is to make them validate the email address if it isn't already.

#

You would need to add a stage that only runs if they aren't activated.

#

The expression would be if user is active false. Then for that stage you would want to select all policies must match to run. Then your email confirmation thing should only fire if active is false but doing an else statement that just makes them active is likely the wrong way to go about it

#

I know that does just give you a flow you can copy and paste. But hopefully makes it clear what you need to do

quaint echo
#

I just saw the option you meant. That the password reset activates the account at the same time. But when I try a password reset I also get a "failed to authenticate".

I need to take a closer look at your suggestions and will need some time to test them. Thank you very much already.

quaint echo
#

I think my problem lies elsewhere and is best understood with the example Flow "examples/flows-recovery-email-verification.yaml".

So I have set up a completely new authentication instance(clean installation):

First, I created a normal user and set it to inactive.

Then I created a new Blueprint instance. (examples/flows-recovery-email-verification.yaml)

I then executed the blueprint instance.

Now I have my recovery flow "default-recovery-flow".

To make the flow work I made a small correction to the expression "default-recoery-skip-if-restored" as stated in this Github post: https://github.com/goauthentik/authentik/issues/3297

After that I deleted the flow cache and opened the flow in an incognito tab: "/if/flow/default-recovery-flow".

Now when I enter the email address of my inactive test user, I get the error message "Failed to authenticate".

This is exactly my problem, if a user is inactive he generally can't pass the "Identification Stage". I think this should not be the case.

If I activate my test user it can pass the "Identification Stage" and get to the Email Recovery Stage.

But it should be possible for a user to pass the "Identification Stage" even if he is inactive, for example to reach the "Email Stage" (Recovery). Or do I see this wrong?

quaint echo
#

My recovery flow now works for inactive users.

Removing the is_active=True check in the identification stage code, will allow inactive users to pass the identification stage and reach my email recovery stage.

/authentik/authentik/stages/identification/stage.py

changed line 175:
user = User.objects.filter(query, is_active=True).first()
to
user = User.objects.filter(query).first()

Not sure if it's a good idea, but how can I else get an inactive user reach the email recovery stage?