Self-service registration with approval

Who this page is for: the administrator of a customer, supplier or partner portal who wants people to ask for an account themselves. What you need first: a working mail server, the Super admin role to change the settings, and a group assigned to the applications new people should reach. Result: the sign-in page offers Create an account; people prove their mailbox, an administrator approves them, and they sign in to the applications you chose.

Self-service registration is off until a Super admin turns on Allow people to create accounts under Identity → Sign-up → Settings. The sign-in page then shows Create an account wherever a sign-up entry is offered. A person types an address, proves it with an emailed code or link, and chooses a name and a password. No account exists until the mailbox is proved and, where the entry requires it, an administrator has approved the request. Approval is on by default.

People who sign up themselves get access to applications, never administrative power.

The examples use the fictional company Acme Corp, which opens its customer portal at https://portal.acme.example to its customers.

Identity → Sign-up has three tabs: Settings, Entries and Waiting for approval.

1. Settings

Setting	Default	Range	What it does
Allow people to create accounts	Off	On or off	The master switch. Turning it on needs a working mail server.
User type	Customer	Employee, Contractor, Partner, Customer, Other	The user type every person who signs up receives.
Block disposable email domains	On	On or off	Refuses addresses at disposable-mail domains, from the list that comes with each release.
Allowed domains	None	Up to 200	When set, only these domains may sign up. A rule covers the domain and its subdomains. With none, any address that is not blocked is accepted.
Blocked domains	None	Up to 200	Domains that may never sign up. Use it for any domain you must refuse today.
Link lifetime (hours)	24	1 to 168	How long the link in the sign-up email works.
Approval window (days)	14	1 to 90	How long a request waits for a decision before it is removed.
Email approvers when a request is waiting	On	On or off	Emails the people who can approve when a request arrives.

The emailed 8-digit code works for 15 minutes by default (5 to 30, the emailed-link setting under Settings → Security). The disposable-domain list cannot be emptied by mistake: SSOGEN does not start without it.

2. Entries: who joins which group

An entry says which group a person who signs up joins. There is one entry for the whole organization and at most one per application.

On an application’s own sign-in, the sign-in page offers that application’s entry.
Everywhere else, it offers the organization’s entry.
The administrator’s sign-in never offers Create an account.

Each entry shows what a new person would reach. The entry lists every application a person who signs up would open: through the entry’s group, through the group Everyone, and through any group that follows a rule for their address. Read it before you save.

Require approval is on for every entry by default. With approval off, a save is refused when people would get more than the entry’s own group gives. With approval on, you confirm the extra access. If an entry’s access grows later and approval is off, the entry stops being offered until you fix it. Turning approval off needs the Super admin right and emails every Super admin.

Applications only, never administrative power

A group that people who sign up would be in cannot approve Remote Access or hold an administrative application role. That covers the entry’s group, a group it is nested in, Everyone, and a group for their address domain.

Saving an entry whose group has such a power is refused, with a message that names the cause.
Naming such a group as a Remote Access approver, or giving it an administrative application role, is refused too.
The rule follows the person. Someone whose account was created by sign-up never approves Remote Access and is never given an administrative application role, even if an administrator later adds them to a group that has that power. Other members of that group keep what it gives them.

If a person who signed up later needs administrative duties, create a separate account for that role.

To offer sign-up for one application alone, open the application and set its entry under Sign-up: the group new people join, and whether the entry requires approval. People who arrive from that application see its entry; people who open the sign-in page directly see the organization’s.

For Acme Corp, the customer portal has its own entry with the group Portal customers and approval on. A customer who arrives from the portal joins that group and waits for approval.

3. Waiting for approval

Requests that proved their mailbox and need approval appear under Waiting for approval.

Open Identity → Sign-up → Waiting for approval.
Approve or reject one request, or select up to 100 and decide them together.
A rejection takes a reason: Spam, Not eligible, Duplicate or Other. You can choose to tell the person.

The person is emailed the decision. An approved person can sign in at once. A request nobody decides is removed when the approval window ends; a request whose email was never confirmed is removed when its link ends. Rejected and expired requests are deleted, not kept.

Find a sign-up looks up one request by the whole email address. It shows whether the sign-up email went out, and you can delete the request there.

4. What the person sees

On the sign-in page, the person chooses Create an account and types an email address.
The page prepares the request in the background (it can show Preparing your request for a moment), then sends an email.
The person types the 8-digit code from the email, or opens the link in it.
The person chooses a name and a password that meets the password policy.
Without approval, the person is signed in. With approval, the page says an administrator will review the request, and the person is emailed the decision.

The page answers the same for every address, so it never shows whether an address already has an account. An address at a domain an identity connection claims is sent to that connection’s sign-in. If the sign-in policy asks for a second step, the person sets it up at the first sign-in. The end user’s guide is Create an account.

Forgot password? works for people who signed up: they type the email address they sign in with and receive a reset link.

5. Protection against fake sign-ups

Sign-up has no picture to read and nothing to click. Before each request, the sign-up page solves a small SHA-256 puzzle in the browser, with no third-party script. SSOGEN signs each puzzle with your organization’s own key, binds it to the client network and accepts it once, within 5 minutes. The puzzle is a mitigation: it slows automated sign-ups and makes them cost more. The limits below are what stop them.

Limit	Value
Sign-up emails to one address	3 a day
Sign-up emails to one email domain	100 an hour
Sign-up emails for the organization	300 an hour
Share of those 300 that one client network may use	60 an hour (an IPv4 address, or an IPv6 /48)
Sign-up requests from one client network	5 a minute

When a limit is reached, the email is not sent and the person sees the same page as always. Because one network can use at most a fifth of the hourly budget, one source cannot use up sign-up for everyone else. A resend with a made-up request is held by its own per-network limit and does not use the budget. A code already delivered keeps working when a later email is held.

Add the allowed and blocked domain lists and approval to these, and a burst of fake requests never becomes an account.

6. Refusals and what they mean

When the console refuses a save, the message names the cause. The common ones:

Message is about	Cause	Fix
Sign-up is off	Allow people to create accounts is off.	Turn it on (Super admin).
More access than the entry’s group	With approval off, new people would reach applications beyond the entry’s own group, for example through Everyone.	Turn approval on, or remove the extra assignment.
The group cannot be used, or is assigned to nothing	The entry’s group is missing, or gives no application.	Choose a group that is assigned to the applications.
The sign-in policy does not admit local accounts	The policy that governs these applications does not accept accounts SSOGEN holds, so a new person could not sign in.	Adjust the sign-in policy, or use another entry.
The group has administrative power	The group, or a group it reaches, approves Remote Access or holds an administrative application role.	Use a group that gives applications only.
A mail server is needed	Outgoing mail is not set up.	Set it up under Settings.

7. On an organization hosted by SSOGEN

Sign-up is turned on for a hosted organization by SSOGEN, and daily and total account limits apply. See Sign-up on a hosted organization.

Check it worked

Open the sign-in page in a private window. Create an account appears where the entry is offered.
Sign up with a test address at a domain you control, for example jane.doe@acme.example. The request appears under Waiting for approval.
Monitoring → Audit shows the registration events: registration.requested, registration.verified, then registration.approved and registration.completed. See the audit event reference.