Bug 28357

Summary: E-mail Verification
Product: Koha Reporter: Christopher Brannon <cbrannon>
Component: PatronsAssignee: Bugs List <koha-bugs>
Status: RESOLVED DUPLICATE QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P5 - low CC: dcook, george, gmcharlt, kyle.m.hall, lisettepalouse+koha
Version: unspecified   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:

Description Christopher Brannon 2021-05-14 22:13:42 UTC
Dead e-mails are a pain to deal with.

It would be great if e-mail notifications were verified, regardless of registering online or in person.  If an e-mail address is entered by staff, Koha should have a flag to indicate if the address has been verified.  When an account is saved or updated, it should check if an e-mail address has been entered.  If so, if it has not been verified, it should send a verification e-mail to the address.  When the patron receives it, they should have to click something or login to complete the verification.  The address is marked in their account as verified.  If the address is changed at all, they have to re-verify.

Staff who receive notice that the e-mail has problems (dead, full, etc) should have a flag they can set on the account to mark the address as bad, and the reason why.  The patron would then have to supply a new e-mail address and verify again.  While the account is flagged with a bad e-mail, notifications to that address should be turned off.  If they have another form of notification, Koha could send them a notification that the e-mail address they supplied is no longer working, and needs to be corrected.
Comment 1 David Cook 2021-05-16 23:26:56 UTC
I like the sound of email verification. 

I usually see this for authentication protocols (see "email_verified" at https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims) and Identity and Access Management software (like Keycloak). 

Besides determining whether an email address is alive or not, it also shows that the email address is actually controlled by the person claiming to control it.
Comment 2 Katrin Fischer 2021-06-03 22:37:31 UTC
I believe this is very similar to bug 23908 and both have good ideas. I am copying the comment from here to there and mark them as duplicate.

*** This bug has been marked as a duplicate of bug 23908 ***