Restrict external identify provider signup to match contact email

(0) Share

Report

Posted on by Richard Mayo

In my testing, it seems possible for a user to signup with a different email to the one an invitation was sent to.

Example

I create a contact with the email user@business.com and email them an invitation code.

The user clicks on the link in the invitation and sets up their account using a 3rd party identity provider (Google, Microsoft, etc) but its their personal account with the email user@personal.com

How do I prevent that from happening?

Categories:

Security

I have the same question (0)

All responses (2)

Answers (1)

Sort by

Verified answer

Inogic 1,291 Moderator on at

Like (0)

Report
Copy link

Link copied!

Hi @richardmayo ,

You can configure the registration form to restrict users from modifying their email addresses.

Please follow the steps given below,

Step 1: Initially we need to Create a Content snippet, set the values as shown in the Screenshot,
Name: Account/Register/PageCopy
Type: HTML

Step 2: Then, Paste the code given below in the Value(HTML) Section
<script>
$(document).ready(()=>{
    emailTextBo = $("#EmailTextBox").val()
    if(emailTextBo != "" || emailTextBo != null){
        $("#EmailTextBox").attr('readonly','readonly')
    }
})
</script>
Please refer to the Screenshot given below,

Step 3: Save and sync the Website,

Finally, In the registration form, users cannot edit the email field as it is locked or set to read-only.

Thanks!

Inogic Professional Services Division
Power Platform and Microsoft Dynamics 365 CRM Development – All under one roof!
Drop an email at crm@inogic.com
Services: http://www.inogic.com/services/
Power Platform/Dynamics 365 CRM Tips and Tricks: http://www.inogic.com/blog/

Was this reply helpful? Yes No
Richard Mayo 40 on at

Like (0)

Report
Copy link

Link copied!

Thanks, @Inogic for the detailed response!
In the end, we went for an AzureB2C solution, but your idea would have worked perfectly!

Was this reply helpful? Yes No