Shibboleth users who predate Shibboleth are assumed to be email-verified but aren't

[donsizemore]

This issue is related to #1401 and possibly supersedes #3300. Per Phil and Pete in IRC Shibboleth users are now assumed to have their e-mail addresses verified as trusted / provided by the IdP. For new users this happens. Existing users such as myself and our archivists remain unverified. I can sign in with my Shibboleth account to our test server running 4.11 and don't get an "emailconfirmed" timestamp:

dvntest=> select emailconfirmed from authenticateduser where email='dls@email.unc.edu';
 emailconfirmed 
----------------

(1 row)

I could start wedging in timestamps for institutional users but would love to find the logic snag.

[pameyer]

I think the logic snag is that when the authenticateduser.emailconfirmed column was added in 4.5.1, it wasn't accompanied by an update setting that column to account creation time for shibboleth users.

[donsizemore]

@pameyer seems better to make current Shib logins check for emailconfirmed and set if necessary — we have a bunch of users matching unc.edu who may or may not sign in going forward. My inner Security Chicken Little would prefer to leave them NULL.

[pameyer]

@donsizemore That seems reasonable to me; but means it would take code changes rather than database cleanup.

[pdurbin]

I'm pretty sure I'm affected by this personally in Harvard Dataverse (I had an old account in the DVN 3.x days and I'm using Shib to log in) and the user experience is pretty terrible. Here are some screenshots from 5.10:

I noticed "Not Verified" and clicked "Verify Email".

I get a "success, email sent" message

The email I received is nonsensical (no link, for example, no content, really)

Knowing what I know from hacking on pull request #8579 recently, I'm aware that the user experience is even further confusing because prior to that pull request if you go back to Account Information and click "Verify Email" a pop up will show (screenshots below). What this popup is TRYING to say is that an email has already been sent. In the that pull request we decided to remove the popup. Here's how it looks in 5.10:

I'm back on "Account Information" (within 24 hours so the link/token is still present in the database)

Confusing popup that's trying to say an email has already been sent

Given all this, what's the plan? Some thoughts:

• We want Shib users to always see "Verified". They should never see a "Send Verification Email" button. They should never have the user experience above.
• From a quick look at the code, emailLastConfirmed (a timestamp) is only set for Shib users on account creation. Perhaps this should be set every time the Shib user logs in. That way, both new users and returning users would be treated the same. (Hopefully installations aren't relying on emailLastConfirmed not changing.) As users log in, emailLastConfirmed will be populated for the ones who didn't have it. That means they won't see the "Send Verification Email" button.

---

Update: Examples of the mostly empty nonsensical email above:

• https://help.hmdc.harvard.edu/Ticket/Display.html?id=316215
• https://help.hmdc.harvard.edu/Ticket/Display.html?id=315336
• https://help.hmdc.harvard.edu/Ticket/Display.html?id=312844
• https://help.hmdc.harvard.edu/Ticket/Display.html?id=312844
• https://help.hmdc.harvard.edu/Ticket/Display.html?id=312043