By: Chris Davenport user 05 Aug 2016 at 8:55 a.m. CDT

5 Responses
Chris Davenport gravatar
I need to customise the user registration process to include verification of the user email address by emailing a random token to the email address they entered. The user account should not be active until they click on a link in the email to confirm they own the email address. But I'm struggling to see which file I need to hack to get this to work (actually, I was a bit surprised to find it wasn't supported "out of the box"). I'm gradually finding my way around Gluu and I've figured out how to send the email from the User Registration jython script, but I'm not sure how to implement the link to get the user account switched from inactive to active. Do I need to add a complete new page/form? Or do I need to hack the postRegister.xhtml page? Either way, I'm not sure how to go about it. Is there any documentation on this? Or sample scripts? Thanks.

By Michael Schwartz Account Admin 05 Aug 2016 at 9:08 a.m. CDT

Michael Schwartz gravatar
Registration is one of the lesser used features of Gluu. I'll assign this issue but it may take some time to get the right answer. I think what you're asking is possible, but we need to dig around to find an example.

By Chris Davenport user 05 Aug 2016 at 9:21 a.m. CDT

Chris Davenport gravatar
Thank you. Your assistance is appreciated.

By Aliaksandr Samuseu staff 05 Aug 2016 at 11:01 a.m. CDT

Aliaksandr Samuseu gravatar
Hi, Michael, hi, Chris. I believe we've had one or two tickets of similar sort already, I'll try to look for them.

By William Lowe user 08 Aug 2016 at 11:54 a.m. CDT

William Lowe gravatar
Chris, One thing to note is that it's easier to handle registration locally within your app, and then send user information to the Gluu Server via the [SCIM protocol](https://gluu.org/docs/api/scim-2.0/). This way you don't have to make any customizations to the Gluu Server. We're going to add some sample code in the docs showing how to do this. Thanks, Will

By Aliaksandr Samuseu staff 16 Aug 2016 at 7:28 p.m. CDT

Aliaksandr Samuseu gravatar
Hi, Chris. Only ticket I've found was a private one, so I can't refer to it. But in it the solution similar to what William was talking about was proposed. But trying to answer your original question: >I'm gradually finding my way around Gluu and I've figured out how to send the email from the User Registration jython script, but I'm not sure how to implement the link to get the user account switched from inactive to active. It seems it isn't possible at the moment. An [enhancement proposal](https://github.com/GluuFederation/oxTrust/issues/324) has just been created at github that attempts to achieve a base framework for registration's confirmation, but it won't be there till 2.4.5 is out (it also may be moved further into the future, as it's not a high priority feature). If waiting is not an option for you, you could try a totally different approach. You would need to implement a custom authentication script, the sole purpose of which would be user's account's activation. As you may already be aware, you can ask for a specific authentication method (amongst those that are enabled on the Custom authentication scripts tab) by adding `acr_values` parameter to an url. So, in your User Registration script you would assign some long random activation key string value to a newly created user entry and persist it in some attribute of it. Then you would need to create custom authentication script (and perhaps custom login page for it) which would consume the activation code passed to it via url parameter (or fragment part of an url). So, you would need to send url like this to your user via email: ``` https://your.gluu.host.name/oxauth/authorize?scope=openid+profile+email+user_name&response_type=code+id_token&nonce=nonce&redirect_uri=https%3A%2F%2Fyour.gluu.host.name%2Fidentity%2Fauthentication%2Fauthcode&client_id=%40%211111.2222.3333.4444%215555%216666.7777%218888%219999.0000 ``` ...plus adding to it `acr_values` parameter with the name of your script, and your custom url parameter containing activation code (You'll need to provide `client_id` that is correct for your instance). There is no guarantee it will work, though. Though using fragment part of url is a promising alternative too (you'll need to create your own custom login page with javascript that will scrap the fragment and provide it to the script somehow) Unfortunately, that's all we can suggest at the moment.