RocketChat / RocketChat/Rocket.Chat

Using OAuth as addition to traditional signup to get "VERIFIED" and "GUEST" accounts.

Open
#10,072 1 comment 2 reactions 1 assignee View on GitHub

Nobody has claimed this yet.

feat: oauth / sso triaged type: improvement
Dominant language
TypeScript
Stars
46.1k
Forks
13.9k
Avg merge
3d 3h
Merged PRs (30d)
130

Description

High level desired use case:

There's a chat related to some service that can authenticate via OAuth as an authoritative source for usernames.

Traditionally you can signup as someuser1 with somename@do.main.com and use few channels enabled for "guests" aka "unverified" users. Resulting name would be unverified-someuser1 to avoid name conflict and possible only if someuser1 doesn't already exist.

You can then use OAuth to authenticate and get verified status that will allow you to get rid of unverified- prefix for username (without loosing message history), get "VERIFIED" badge, access other channels and ability to initiate direct messaging, etc.

Rephrasing: unverified-username3 is allowed to be changed to username3 and getting VERIFIED badge after one can successfully authenticate against OAuth (and keep e-mail setting from traditional signup if OAuth doesn't provide one)

Obviously dealing with tons of current users would be a problem (to migrate them from someuser2 to unverified-someuser2.

Also, currently signup using OAuth only, might be problematic for some of the features (like mail notification) in such cases when OAuth doesn't provide e-mail. In such case it should fallback to e-mail provided via traditional signup.
Possibly related to: #6528 and #6483

All that will help with phishing attempts, abusing well known usernames on associated service, thus might be valuable for #8284

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.