Verify user's email address while creating a new account

[Jeff Zhuk, modificado 13 Anos atrás.]

Liferay currently can validate email address based on its syntax, but (please correct me if I am wrong) it does not verify that this email address actually belongs to the user.

To verify the valid user's addresses I added to the email message the "Activate Account" link.
Only after the user follows the link from her/his email box, the system will finish the "create account" process.

Changes:

com.liferay.portal.service.impl.UserLocalServiceImpl.java
// set sendEmailand userActivationUrl in the property file to enable this feature
public User addUser(
….
// custom to verify email address
boolean activate = true;
if(emailAddress != null && emailAddress.length() > 0 && sendEmail) {
activate = false;
}
user.setActive(activate);

….

// custom to verify email address – added the activation URL to the email template (1 line)
String userActivationUrl = Stats.getAppDetailsByKeyName("osicdao", "userActivationUrl");
body = StringUtil.replace(
body,
new String[] {
"[$FROM_ADDRESS$]",
"[$FROM_NAME$]",
"[$PORTAL_URL$]",
"[$TO_ADDRESS$]",
"[$TO_NAME$]",
"[$USER_ID$]",
"[$USER_PASSWORD$]",
"[$USER_ACTIVATION_URL$]",
"[$USER_SCREENNAME$]"
},
new String[] {
fromAddress,
fromName,
company.getVirtualHost(),
toAddress,
toName,
String.valueOf(user.getUserId()),
password,
userActivationUrl,
user.getScreenName()
});


Here is the activation URL added to the template
com.liferay.portlet.admin.dependencies.email_user_added_body.tmpl

<a href="[$USER_ACTIVATION_URL$]userId=[$USER_ID$]">Click on this link to activate your account</a>

The userActivationUrl leads to the new Struts action: ActivateUser.
This action simply does:

user.setActive(true); // finalize the "create account" 2-step process

[Jorge Ferrer, modificado 13 Anos atrás.]

Hi Jeff,

Thanks for the proposal. You'll be happy to know that this feature has already been added to Liferay 6.

[Jeff Zhuk, modificado 13 Anos atrás.]

Thanks! Hopefully we help to better advertise the feature :-)

Jeff

[Simon Gołębiewski, modificado 13 Anos atrás.]

Jorge Ferrer:

Hi Jeff,

Thanks for the proposal. You'll be happy to know that this feature has already been added to Liferay 6.

Jorge,

I'm using latest build of Liferai 6.0.4 and I don't see such functionality. Could you please write a little more about it for example where Can i enable it?

Cheers,
Simon

[Jorge Ferrer, modificado 13 Anos atrás.]

Hi Simon,

I'm sorry to say that you seem to be right. I misunderstood the feature that had been implemented, which is similar but different. What was implemented was a way to send a password reset email (check http://issues.liferay.com/browse/LPS-5968 for details).

Part of that development could probably be reused to implement what Jeff suggested. It would require some development but it shouldn't be hard. I'll also suggest adding it to the roadmap for future versions.

[Jeff Zhuk, modificado 13 Anos atrás.]

Jorge,

Besides the source that I provided above, the new property is expected in the portal.property file: "account_activation_url". If this property is present, the create_account action becomes a two-step process.

Feel free asking any questions.
I'll be happy to share,

Thank you,

Jeff

[Juan Fernández, modificado 13 Anos atrás.]

Created a ticket for this new functionality here

[Jeff Zhuk, modificado 13 Anos atrás.]

Juan,

Thank you!

Jeff (Yefim)

[Frerk Meyer, modificado 13 Anos atrás.]

Hello Jeff,

I have to implement the same functionality for Liferay 5.1.2.

How do you generate the UrlActivationUrl and on which Portlet did you add the activeUser Struts action?

As I understand it the Url has to be public, so one must be careful to not introduce a security risk. A secret other than the users email address should be sent via emial before and checked. Then the resulting page could display a generated password. If you restrain the access to https, the initial random password would only be transmitted encrypted. And it wouldn't be mailed in clear text together with teh login (email-address).

Sincerely

Frerk Meyer

[Jeff Zhuk, modificado 13 Anos atrás.]

Frerk,

>How do you generate the UrlActivationUrl?

Activation Url can be provided as another "init-param" in the portlet.xml of my custom portlet.
I read this property during the servlet initiation (application start time) and do the substitution.
Potentially, this can be different for each portlet.

>on which Portlet did you add the activeUser Struts action?

I add the struts action to my portlet (the same portlet where I added the Activation Url)

As you can see I don't change existing standard portlets but use my own to add this feature.

With the Liferay implementation this will be part of a standard package.

There is no need to display any page with the password or hidden field with the password.
Server will email the link which user clicks to confirm receiving. The link includes the activation action name. Server confirmation procedure might include restriction on time (48 hours, for example) for further security. User will have to login again and this login will be compared to previously stored original login. Then user might be forced to change the login.

Thank you for good questions,

Jeff (Yefim)

P.S. I did not see your post before, sorry for late response

[Natasa Bulatovic, modificado 12 Anos atrás.]

Dear all


Does Liferay 6.0.6 CE supports the feature of email confirmation during user registration and how to integrate it?
Otherwise, is there any other community portlet that enables it?

[Juan Fernández, modificado 12 Anos atrás.]

Hi Natasa:
this has been implemented for Liferay 6.1, so it's not available in your version.
You can read the ticket about this here: http://issues.liferay.com/browse/LPS-11606
Regards

[Natasa Bulatovic, modificado 12 Anos atrás.]

Thanx Juan

[fabio foglia, modificado 12 Anos atrás.]

Hi Jeff,

My portal version is 6.0.6.

I'm really going crazy to implement this feature.

I know this feature I coming out in 6.1 but I didn't find any release date.

I'm now able to create avery new account disabled by default modifying the original UserLocalServiceImpl source code where I've found:

user.setActive(true);

Now I'trying to implement the second step but I don't understood how to preceed.

Are you used you own Login portlet or extendend the original one with a hook?

Where can I put the ActivateUser action? Have I to modify default struts-config.xml?

You say "As you can see I don't change existing standard portlets but use my own to add this feature" but I see that the first custom code has impact in UserLocalServiceImpl code, right?

com.liferay.portlet.admin.dependencies.email_user_added_body.tmpl is new file and where have I to put?

I (and I think many other guis) just need some more info to find the way...

I'm just now looking at liferay/c/portal/verify_email_address action present in 6.1 to get the solution.

This action produce a link that fill a field in a form with a long number and It works well...

Thank you

Fabio

[Bijan Vakili, modificado 12 Anos atrás.]

Fabio Foglia:

Hi Jeff,

My portal version is 6.0.6.

I'm really going crazy to implement this feature.
....

Fabio

Hey, attached is ext plugin patch for 6.0.6 for this issue.

It introduces a new property "company.security.strangers.create.after"; set it to "true" to make this work.

company.security.strangers.create.after=true

Take note that the portal-ext.properties file in this EXT plugin may overwrite an existing ${CATALINA_HOME}/webapss/ROOT/WEB-INF/classes/portal-ext.properties file, if one exists.

Thanks.

[Hitoshi Ozawa, modificado 12 Anos atrás.]

If you're writing an ext plugin, instead of overwriting portal-ext.properties, it would have been better to overwrite portal.properties included in portal-impl.jar.