We are looking into Cloud, alt. OSS for our platform. Everything looks nice and all, but one case is throwing us off right now. Users should not be able to register themselves. We only want to use Social sign in providers as well. From our tests, creating an identity through the api is not enough as the sso process is still marked as registration flow (makes sense in some way tho), is there any way around this? Our only knowledge of the user is email and name etc. One solution is to let everyone register and we check if the email is provisioned or exists on our end in the callback - else delete the identity server side and be done with it. Maybe the latter is how it is done?

Thank you for the question! Not sure if I understand the use case correctly. How can users enroll to your service using social sign up, when they can’t register themselves? I assume that you (the admin) do not have control over their social profiles?

Ok so we just have plain username/pw login today which is built into the API. Users cant register, since it is a B2B service. Admins create users and an invitation is sent. So we kind of want the same logic, think of it like a whitelist or if the identity exists with trait xy.

I see, to allow only certain domain names from signing up you can use web hooks. In the web hook, you can cancel the registration request. The docs for this are not merged yet, but you can find them here: https://github.com/ory/docs/pull/678/files

Ah yes might work! Is this possible to do in cloud?

Absolutely 🙂

Looks nice. So just update the conf through the ory cli?

yup 🙂 if you have problems with that @magnificent-energy-493 can probably help :)

Thank you very much, going to try some stuff out now 🙂

Hi @rhythmic-whale-28602 Every flow has a web hook that can alter the flow. So in your system, if you decide all users with a certain email should be disable, you can just return an error on the response to the web hook

Nice, should be able to do some fun things with those then

Hi vincent, it’s possible that we missed migrating this config entry to the cloud system

Npnp. If you can answer this, then it won't be that critical atm: If I do a blocking hook in registration.after, let's make it fail. Does it still save the user identity?

no, it would not create the identity afaik

Ah great, was wondering where in the flow this was ran. But good to know that this is the thought. What is the timeline for getting the interrupt in cloud? It's not super important now, since I am still making a Frankenstein poc with our current system, no prod :)

we’ll finish up a couple of other features first but I’d say probably 4-6 weeks-ish depending on how urgent it is

That works for me!

Anything special?

what do you mean? 🙂

The other keys that are not supported 😄

ah

Ahh, got it