Account Manager

Account managers handle user accounts for the authentication. They are used in the Authentication Service and in the Token Service when access to the account is needed.

The following tasks are performed by an account manager:

  1. Create new accounts
  2. Delete accounts
  3. Update accounts
  4. Activate accounts
  5. Link accounts
  6. Look up accounts
  7. Look up linked accounts
  8. Delete links on accounts

Registration - Create account

Registration is the process of creating new accounts. It can be used if the account manager has registration enabled in the configuration.

When registration is enabled, authenticators (such as the html-form authenticator) will show the registration option, and users can create accounts.

Account Verification Method

Account Verification deals with making sure that the user exists. Typically this is done by sending an email with a confirmation link to the address the user has entered.

Before Account Verification the account is de-activated, and the user cannot authenticate.

Note

Account registration attempts can be throttled. See Throttling.

If the Account Verification Method is set to email-verification or totp-email-verification, it is also possible to configure the following settings:

  • max-verification-period

Defines how long the user has to activate the account by using the relevant verification method. After this period has elapsed, the account can no longer be activated using the verification method unless the registration is restarted. In some cases, the only way to activate the account after this period has elapsed is by using another mechanism, such as the User Management APIs.

  • max-unverified-account-period

If configured, defines an expiration time for accounts that did not get activated after registration. After this period has elapsed, the un-activated account is eligible to be deleted the next time someone attempts to register an account with the same email address, so that the newer registration can proceed.

This setting is related to, but not the same as max-verification-period. While max-verification-period is a time limit for the user to complete their account registration, max-unverified-account-period is a time limit in which the presence of the un-activated account may forbid other accounts from registering with the same email address.

Hint

If max-unverified-account-period is not configured, it is possible for a malicious user to register several email addresses without actually verifying them, which makes it impossible for the legitimate owners of those email addresses to later register an account with them. By configuring this setting, that can be prevented.

See Enable-registration for the full configuration options available.

Username is Email

The setting username-is-email (and corresponding AccountManager.useUsernameAsEmail method in the SDK service) specifies that the username is to be used as primary email whenever an email is needed.

When set, this means that no other email attribute is required for the account, and the email field in the Create Account or Reset Password page is hidden.

All emails, such as Activation or Reset Password will be sent to the email from the username attribute. This requires all user names to be functional email addresses.

Note

If Active Directory is used as the account data source, this setting cannot be used. Active Directory requires a sAMAccountName which is not in the form of an email.