Bug 28357 - E-mail Verification
Summary: E-mail Verification
Status: RESOLVED DUPLICATE of bug 23908
Alias: None
Product: Koha
Classification: Unclassified
Component: Patrons (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2021-05-14 22:13 UTC by Christopher Brannon
Modified: 2021-06-03 22:37 UTC (History)
5 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Christopher Brannon 2021-05-14 22:13:42 UTC
Dead e-mails are a pain to deal with.

It would be great if e-mail notifications were verified, regardless of registering online or in person.  If an e-mail address is entered by staff, Koha should have a flag to indicate if the address has been verified.  When an account is saved or updated, it should check if an e-mail address has been entered.  If so, if it has not been verified, it should send a verification e-mail to the address.  When the patron receives it, they should have to click something or login to complete the verification.  The address is marked in their account as verified.  If the address is changed at all, they have to re-verify.

Staff who receive notice that the e-mail has problems (dead, full, etc) should have a flag they can set on the account to mark the address as bad, and the reason why.  The patron would then have to supply a new e-mail address and verify again.  While the account is flagged with a bad e-mail, notifications to that address should be turned off.  If they have another form of notification, Koha could send them a notification that the e-mail address they supplied is no longer working, and needs to be corrected.
Comment 1 David Cook 2021-05-16 23:26:56 UTC
I like the sound of email verification. 

I usually see this for authentication protocols (see "email_verified" at https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims) and Identity and Access Management software (like Keycloak). 

Besides determining whether an email address is alive or not, it also shows that the email address is actually controlled by the person claiming to control it.
Comment 2 Katrin Fischer 2021-06-03 22:37:31 UTC
I believe this is very similar to bug 23908 and both have good ideas. I am copying the comment from here to there and mark them as duplicate.

*** This bug has been marked as a duplicate of bug 23908 ***