enough-vase-33352
05/05/2025, 7:33 AMbrief-egg-61061
05/05/2025, 7:33 AMbrief-egg-61061
05/05/2025, 7:33 AMjsonnet local claims = { email_verified: false, } + std.extVar('claims'); { identity: { traits: { [if 'email' in claims && claims.email_verified then 'email' else null]: claims.email, // Allowing unverified email addresses enables account // enumeration attacks, if the value is used for // verification or as a password login identifier. }, }, }
This approach allows you to selectively handle email verification for specific OIDC providers [Auth0 Social Sign-In](https://www.ory.sh/docs/kratos/social-signin/auth0) and [GitLab Social Sign-In](https://www.ory.sh/docs/kratos/social-signin/gitlab). Additionally, there was a known issue where the "Require Verified Address for Login" setting wasn't properly applied to OIDC identities, but this has been fixed according to the knowledge sources [Github Issue #246](https://github.com/ory/network/issues/246). If you want to require verified addresses only for specific authentication methods, you can configure the require_verified_address
hook for specific methods rather than globally: ory patch identity-config {project_id} \ --add '/selfservice/flows/login/after/password/hooks=[{"hook": "require_verified_address"}]'
You can omit adding this hook for the OIDC methods you want to exempt from email verification requirements. Note that there are some limitations and potential issues with verification across different authentication methods, as indicated by some of the GitHub issues in the knowledge sources. For example, there's an open issue about verification emails being sent when signing up with SMS code.