[OpenID-ORCID-OJS3.5] Validation of e-mails during registration w/ ORCID

Software Support
1

After logging in with ORCID to register a new OJS account, OJS asks for an email address.

If I have “require_validation = On” in config.inc.php, will the email address provided during this OpenID-ORCID registration require validation?

I tested this and looks like the validation wasn’t required, which seemed really strange — because what’s the point of asking for an email while “require_validation” is on, but not actually requiring validation during this ORCID registration method, right?

Initially, I thought OJS would automatically retrieve the same email address associated with the user’s ORCID account. However, since the system explicitly asks for an email address, it seems that if “require_validation = on” is enabled, the ideal behavior would be to require validation of the new email address provided. Otherwise, the rule in config.inc.php loses its practical purpose and could lead to registration issues — which would be a pain to fix once that specific ORCID iD is already linked to an account.

Posting this doubt here as instructed by @asmecher . Thx for the patience!

2

I tested the scenario several more times (with test emails and accounts), and indeed, there is no email validation.

Also discovered kind of a bug during registration with ORCID: the email address is not automatically filled — even though the first and last name fields are filled correctly with the info provided from ORCID.

During testing, some serious issue occurred: I accidentally registered an account with the email address “@gmailgmailgmailgmailgmailgmailgmailgmail. com. BR” (an obviously invalid domain for Gmail). I wasn’t able to change the contact email in the profile, since the confirmation email for the change would never reach the wrong address. I also couldn’t register another account, because the ORCID was already linked to that broken account. The only solution was to delete the account through the user merge system with the manager profile.

It would be easy to solve these problems with e-mail validation or a “confirm e-mail address” field to write the e-mail address again.