Update email address process

Getting advice
1

Hello,
we integrated the keycloak workflow for changing the email address (email as username) into our application. That means that after changing the email address it will be changed right away. Only after the next login (with the new email address) you will see the “email verified” page.

We would like to change this workflow to:
change email address -> get email to verify email change via link -> click link -> show “email verified” page

I could not find any information regarding the email change process in the documentation and the admin console. Is there any possibility to modify the process?

8 Likes
2

Yes, this is a big security issue, as a user can impersonate someone else because of this non email verification.

1 Like
3

Hi,

Did you find anything new about this ?

Regards,

Dan

4

This leads to another problem: If the user makes a typo and accidentally enters a wrong email address, he will not be able to log in again.

The process is useless after all. Or have I overlooked something?

5

Has anyone worked this out. It is a problem for me too.

6

We have the same problem, this makes the email change process unusable for us.

7

Same issue here, need to verify email when changing to a new one.

8

There is a ticket in the JBoss issue tracker for the email verification on the email change. From this ticket, it’s expected to have this functionality in the Keycloak v15.0.0. However, the PR is still open at the current moment. Stay tuned :wink:

1 Like
9

We have same concern, changing email before verification happens is not user friendly. Typo in email adress will make inpossible to login and require contacting support(admin) for email adjusment.

10

Hi, I used the user’s mobile number as a username with keycloak, now I want to provide a possibility to users to be able to change their username (mobile number), how can I do that? how do you integrate the keycloak workflow for changing the email address?