<turbo-stream action="append" target="posts_list"><template>    <div class="postbit" id="307755" data-post-id="307755">
  <section>
    <div class="post-wrap">


					<div class="post-header">
		        <div class="user-avatar">
		          <img alt="lcabrini" src="https://forum.elixirforum.com/user_avatar/forum.elixirforum.com/lcabrini/120/32329_2.png" width="120" height="120" />
		        </div>
					
						<div class="user-details">
		          <div class="user-name">
		            <h3>
                  lcabrini
                    <span class="op-star" title="Thread Starter">
                      <img alt="OP" class="op-star-icon" src="/assets/thread-icons/thread-icon-thread-starter-df91e872.png" />
                    </span>
                  </h3>
		          </div>
						
						</div>
					
					</div>

	        <div class="thread-main">
	            <div class="post-body" data-turbo="false">
								<aside class="quote no-group" data-username="adw632" data-post="10" data-topic="59246">
<div class="title">
<div class="quote-controls"></div>
<img alt="" width="24" height="24" src="https://forum.elixirforum.com/letter_avatar_proxy/v4/letter/a/9d8465/48.png" class="avatar"> adw632:</div>
<blockquote>
<p>How does the admin provide passwords for the users they setup? How do you do this securely?</p>
</blockquote>
</aside>
<p>I’m not sure, to be honest. I’m a developer that follows a spec I’ve been given. I have fairly little insight into how the client actually uses the software. I’d have to talk to the training or devops guys. They interact with the clients.</p>
<aside class="quote no-group" data-username="adw632" data-post="10" data-topic="59246">
<div class="title">
<div class="quote-controls"></div>
<img alt="" width="24" height="24" src="https://forum.elixirforum.com/letter_avatar_proxy/v4/letter/a/9d8465/48.png" class="avatar"> adw632:</div>
<blockquote>
<p>Are you using local password or an external authentication service such as social login via Google, Facebook, Apple etc?</p>
</blockquote>
</aside>
<p>Local, only. Once you get out of the major cities, Internet here can be really flaky. In some places it can be completely off for days and even when it’s not, it can be really unreliable.</p>
<aside class="quote no-group" data-username="adw632" data-post="10" data-topic="59246">
<div class="title">
<div class="quote-controls"></div>
<img alt="" width="24" height="24" src="https://forum.elixirforum.com/letter_avatar_proxy/v4/letter/a/9d8465/48.png" class="avatar"> adw632:</div>
<blockquote>
<p>If you are using a local password an alternative approach than say sharing passwords with these user’s would be to set a random pre-expired password and to send a confirmation link to the user. When the user comes back, force a first time password reset, this way you’re using time limited confirmation links and only the user knows their password going forward. You generally always want to avoid the admins having visibility of user passwords.</p>
</blockquote>
</aside>
<p>Good idea, apart from the fact that it again relies on external resources. We could of course fire up a local postfix server. Just seems a little more trouble than its worth. Somebody’s going to have to administer the server.</p>
<aside class="quote no-group" data-username="adw632" data-post="10" data-topic="59246">
<div class="title">
<div class="quote-controls"></div>
<img alt="" width="24" height="24" src="https://forum.elixirforum.com/letter_avatar_proxy/v4/letter/a/9d8465/48.png" class="avatar"> adw632:</div>
<blockquote>
<p>If you have also established secret/answer challenge questions, this would also be the right time to use them.</p>
</blockquote>
</aside>
<p>It’s not in any spec yet, but it might be something for the future.</p> 
	            </div>

	            <div class="base-line">
	                <div class="thread-counters">
	                    <span class="thread-count count-likes js-likers-trigger" title="Likes" data-post-id="307755" data-batch-url="/posts/batch_likers">
                        0
                      </span>
                      <!-- <span class="thread-count js-solved-indicator" title="Marked as solution"></span> -->
	                </div>
	                <div class="go-to-post">
	                  <a title="Go to post" alt="Go to post" href="https://forum.elixirforum.com/t/how-to-create-accounts-without-self-registration/59246/12">Post #11</a>
	                </div>
	            </div>
              <div id="likers-container-307755" 
                   class="likers-container"
                   data-first-post="false"
                   data-batch-url="/posts/batch_likers">
                   <div class="likers-placeholder" 
                     data-likers-post-id="307755"
                     data-batch-url="/posts/batch_likers">
                  <div class="post-likers"></div>
                </div>
              </div>
	        </div>
			

    </div>

    <div class="triangle-top-right type-standard-post cat-standard-post" title="Post #11"></div>
  </section>
</div>
    <div class="postbit" id="307771" data-post-id="307771">
  <section>
    <div class="post-wrap">


					<div class="post-header">
		        <div class="user-avatar">
		          <img alt="Kurisu" src="https://forum.elixirforum.com/user_avatar/forum.elixirforum.com/Kurisu/120/14820_2.png" width="120" height="120" />
		        </div>
					
						<div class="user-details">
		          <div class="user-name">
		            <h3>
                  Kurisu
                  </h3>
		          </div>
						
						</div>
					
					</div>

	        <div class="thread-main">
	            <div class="post-body" data-turbo="false">
								<p>Just to add another different way to do things, I’d like to share with you the following post which is in two parts.</p>
<p><a href="https://experimentingwithcode.com/restricting-registrations-when-using-phx-gen-auth-part-1/" rel="noopener nofollow ugc">restricting-registrations-when-using-phx-gen-auth-part-1</a><br>
<a href="https://experimentingwithcode.com/restricting-registrations-when-using-phx-gen-auth-part-2/" rel="noopener nofollow ugc">restricting-registrations-when-using-phx-gen-auth-part-2</a></p>
<p>While it may not be exactly what you’re seeking, I humbly believe that it could potentially serve a similar purpose in certain scenarios. For example, in my case, I didn’t want to allow public self-registration on a platform reserved only for administrators. I was largely inspired by the blog post I cited, to extend the authentication system generated by phx.gen.auth for my own purposes. I made some modifications of course but the bulk of the work comes from this article.</p>
<p>The main lines of what I set up:</p>
<ul>
<li>
<p>A superadmin can generate a registration link (whose token expires in 24h) which he will copy and send to the future admin by a means of his choice.</p>
</li>
<li>
<p>The registration token which is saved in the database is scoped on information such as the role of the future user, the id of the superadmin who generated it. If you want you can put other information like the email of the future user, etc. In my case, I prefer to leave this to the concerned person himself when creating his account later.</p>
</li>
<li>
<p>I practically didn’t change anything in the code generated by phx.gen.auth but I just modified in my router.ex file the directive that pointed to the registration page so that it now uses an additional parameter which is nothing other than the registration token. The registration logic naturally will change a bit depending on what you have planned. You need to check if the token is valid and maybe customize and initialize the registration form according to the information you want to leave to the control of the user creating his account. For example, enter his own email and password that he will be the only one to know then. For the role in my case it’s not something he can control naturally so it is assigned to him automatically when creating the account.</p>
</li>
<li>
<p>I didn’t touch the confirmation logic because it can’t hurt. I prefer to automatically confirm my users if necessary. And incidentally, confirming an email, for me, is also a bit for cases where someone makes a mistake by entering someone else’s email. And if we want to reinforce things a bit, we could invalidate this registration by deleting the account after a certain delay without confirmation for example.</p>
</li>
</ul>
<p>There you go. ^^</p>
<p>Hoping that you also find some utility to the links that I shared above.</p> 
	            </div>

	            <div class="base-line">
	                <div class="thread-counters">
	                    <span class="thread-count count-likes js-likers-trigger" title="Likes" data-post-id="307771" data-batch-url="/posts/batch_likers">
                        2
                      </span>
                      <!-- <span class="thread-count js-solved-indicator" title="Marked as solution"></span> -->
	                </div>
	                <div class="go-to-post">
	                  <a title="Go to post" alt="Go to post" href="https://forum.elixirforum.com/t/how-to-create-accounts-without-self-registration/59246/14">Post #13</a>
	                </div>
	            </div>
              <div id="likers-container-307771" 
                   class="likers-container"
                   data-first-post="false"
                   data-batch-url="/posts/batch_likers">
                   <div class="likers-placeholder" 
                     data-likers-post-id="307771"
                     data-batch-url="/posts/batch_likers">
                  <div class="post-likers"></div>
                </div>
              </div>
	        </div>
			

    </div>

    <div class="triangle-top-right type-standard-post cat-standard-post" title="Post #13"></div>
  </section>
</div>
    <div class="postbit" id="307778" data-post-id="307778">
  <section>
    <div class="post-wrap">


					<div class="post-header">
		        <div class="user-avatar">
		          <img alt="adw632" src="/assets/icons/user-9f439610.png" width="120" height="120" />
		        </div>
					
						<div class="user-details">
		          <div class="user-name">
		            <h3>
                  adw632
                  </h3>
		          </div>
						
						</div>
					
					</div>

	        <div class="thread-main">
	            <div class="post-body" data-turbo="false">
								<aside class="quote no-group" data-username="sodapopcan" data-post="11" data-topic="59246">
<div class="title">
<div class="quote-controls"></div>
<img alt="" width="24" height="24" src="https://forum.elixirforum.com/user_avatar/forum.elixirforum.com/sodapopcan/48/34668_2.png" class="avatar"> sodapopcan:</div>
<blockquote>
<p>invite I’m now not seeing how requiring an extra confirmation step on top of that is really that much more secure. If users are requesting invites then it probably makes sense, though they would still need access to the email to get the invites so it doesn’t seem all that much more secure.</p>
</blockquote>
</aside>
<p>Yeah I was only targeting admin created users, it would just send a link to the new users email and that user can use that to complete the registration and set their password pretty much what <a class="mention" href="/u/kurisu" rel="nofollow">@Kurisu</a> has shown.</p> 
	            </div>

	            <div class="base-line">
	                <div class="thread-counters">
	                    <span class="thread-count count-likes js-likers-trigger" title="Likes" data-post-id="307778" data-batch-url="/posts/batch_likers">
                        1
                      </span>
                      <!-- <span class="thread-count js-solved-indicator" title="Marked as solution"></span> -->
	                </div>
	                <div class="go-to-post">
	                  <a title="Go to post" alt="Go to post" href="https://forum.elixirforum.com/t/how-to-create-accounts-without-self-registration/59246/15">Post #14</a>
	                </div>
	            </div>
              <div id="likers-container-307778" 
                   class="likers-container"
                   data-first-post="false"
                   data-batch-url="/posts/batch_likers">
                   <div class="likers-placeholder" 
                     data-likers-post-id="307778"
                     data-batch-url="/posts/batch_likers">
                  <div class="post-likers"></div>
                </div>
              </div>
	        </div>
			

    </div>

    <div class="triangle-top-right type-standard-post cat-standard-post" title="Post #14"></div>
  </section>
</div>
    <div class="postbit" id="307817" data-post-id="307817">
  <section>
    <div class="post-wrap">


					<div class="post-header">
		        <div class="user-avatar">
		          <img alt="sodapopcan" src="https://forum.elixirforum.com/user_avatar/forum.elixirforum.com/sodapopcan/120/34668_2.png" width="120" height="120" />
		        </div>
					
						<div class="user-details">
		          <div class="user-name">
		            <h3>
                  sodapopcan
                  </h3>
		          </div>
						
						</div>
					
					</div>

	        <div class="thread-main">
	            <div class="post-body" data-turbo="false">
								<p>I’m getting a bit confused by the flow of this discussion and I probably should have started a new topic.  I have a solution that works for my usecase, I was just wondering about this:</p>
<aside class="quote no-group" data-username="Kurisu" data-post="14" data-topic="59246">
<div class="title">
<div class="quote-controls"></div>
<img alt="" width="24" height="24" src="https://forum.elixirforum.com/user_avatar/forum.elixirforum.com/kurisu/48/14820_2.png" class="avatar"> Kurisu:</div>
<blockquote>
<p>I prefer to automatically confirm my users if necessary.</p>
</blockquote>
</aside>
<p>This is what I am doing but Benjamin said maybe it wasn’t such a good idea.  But there is a good chance I wasn’t being very clear, which at this point seems <em>very</em> possible <img src="https://forum.elixirforum.com/images/emoji/apple/sweat_smile.png?v=15" title=":sweat_smile:" class="emoji" alt=":sweat_smile:" loading="lazy" width="20" height="20"></p>
<p>Also, thanks <a class="mention" href="/u/kurisu" rel="nofollow">@Kurisu</a> for the <a href="http://experimentingwithcode.com" rel="noopener nofollow ugc">experimentingwithcode.com</a> link, there is some good stuff on that blog in general.</p> 
	            </div>

	            <div class="base-line">
	                <div class="thread-counters">
	                    <span class="thread-count count-likes js-likers-trigger" title="Likes" data-post-id="307817" data-batch-url="/posts/batch_likers">
                        1
                      </span>
                      <!-- <span class="thread-count js-solved-indicator" title="Marked as solution"></span> -->
	                </div>
	                <div class="go-to-post">
	                  <a title="Go to post" alt="Go to post" href="https://forum.elixirforum.com/t/how-to-create-accounts-without-self-registration/59246/16">Post #15</a>
	                </div>
	            </div>
              <div id="likers-container-307817" 
                   class="likers-container"
                   data-first-post="false"
                   data-batch-url="/posts/batch_likers">
                   <div class="likers-placeholder" 
                     data-likers-post-id="307817"
                     data-batch-url="/posts/batch_likers">
                  <div class="post-likers"></div>
                </div>
              </div>
	        </div>
			

    </div>

    <div class="triangle-top-right type-standard-post cat-standard-post" title="Post #15"></div>
  </section>
</div>
    <div class="postbit" id="307819" data-post-id="307819">
  <section>
    <div class="post-wrap">


					<div class="post-header">
		        <div class="user-avatar">
		          <img alt="LostKobrakai" src="https://forum.elixirforum.com/user_avatar/forum.elixirforum.com/LostKobrakai/120/3072_2.png" width="120" height="120" />
		        </div>
					
						<div class="user-details">
		          <div class="user-name">
		            <h3>
                  LostKobrakai
                  </h3>
		          </div>
						
						</div>
					
					</div>

	        <div class="thread-main">
	            <div class="post-body" data-turbo="false">
								<aside class="quote no-group" data-username="sodapopcan" data-post="9" data-topic="59246">
<div class="title">
<div class="quote-controls"></div>
<img alt="" width="24" height="24" src="https://forum.elixirforum.com/user_avatar/forum.elixirforum.com/sodapopcan/48/34668_2.png" class="avatar"> sodapopcan:</div>
<blockquote>
<p>I was thinking about this more. As far as I can tell, the main security risk here is that someone intercepts the invite email, likely by already having access to that email account. So sending out a “regular” confirmation email afterwards is not going to help.</p>
</blockquote>
</aside>
<p>Yeah. If the invitation already works via email, then another confirmation is not needed. But that’s not always the case for systems, where “admins” create accounts.</p>
<p>Edit: Even in the former case you still want to retain the fact that confirmation happened.</p> 
	            </div>

	            <div class="base-line">
	                <div class="thread-counters">
	                    <span class="thread-count count-likes js-likers-trigger" title="Likes" data-post-id="307819" data-batch-url="/posts/batch_likers">
                        3
                      </span>
                      <!-- <span class="thread-count js-solved-indicator" title="Marked as solution"></span> -->
	                </div>
	                <div class="go-to-post">
	                  <a title="Go to post" alt="Go to post" href="https://forum.elixirforum.com/t/how-to-create-accounts-without-self-registration/59246/17">Post #16</a>
	                </div>
	            </div>
              <div id="likers-container-307819" 
                   class="likers-container"
                   data-first-post="false"
                   data-batch-url="/posts/batch_likers">
                   <div class="likers-placeholder" 
                     data-likers-post-id="307819"
                     data-batch-url="/posts/batch_likers">
                  <div class="post-likers"></div>
                </div>
              </div>
	        </div>
			

    </div>

    <div class="triangle-top-right type-last-post cat-last-post" title="Last post!"></div>
  </section>
</div>
</template></turbo-stream><turbo-stream action="replace" target="load-more-container"><template><div id="load-more-container" class="load-more-container">
    <span class="all-loaded">— All posts loaded —</span>
</div></template></turbo-stream>