Sign-up and the mail server
Let people create their own accounts, and send invitations by email.
On this page
KRISID can send invitation links itself, and it can let people create their own accounts with their work email address. Both need a mail server, so this page starts with that.
Before you start
- You need Manage users and roles (ACCESS_MANAGE) for both screens.
- Ask whoever runs your email for the SMTP server name, the port, and an account KRISID may send from. A company relay may need no account at all.
Set up the mail server
Everything is on Administration → Email. Each line is click-to-edit.
- Server: your provider's SMTP host, for example
smtp.office365.com. - Port: usually 587. The hint beside it reads 587 starttls · 465 ssl · 25 none.
- Protected by:
starttls,sslornone, to match the port. - Sign in as: the mailbox or account name. Leave it empty for a relay that doesn't need a sign-in.
- Password: type it and press Store it. KRISID encrypts it and never shows it again. The line underneath shows it as dots, how many characters are stored, and when it was last changed and by whom. To rotate it, type the new one and press Store it again.
- From: the address messages come from. It usually has to be an address that the account in Sign in as is allowed to send as. From name is optional.
- Last of all, press Switch it on beside Sending.
The note beside Sending always names the next thing that is missing. When nothing is missing, it says ready. Nothing is sent while it is off.
The password is encrypted with a key that is kept outside the database. That means a copy of the database doesn't include a usable password. If that key is ever lost or changed, the stored password can no longer be read, and you'll need to store it again.
Send a test
- Under the settings, leave Send a test to empty to send to the address on your own account, or type another address.
- Press Send a test.
If the message doesn't go, the screen shows the mail server's own reply. Every message KRISID tries to send, including invitations and sign-up confirmations, is listed under What has been sent, marked sent or failed.
Gmail and Google Workspace
Google refuses your ordinary password. Use an app password instead:
- 2-Step Verification must be on for the Google account.
- Create the app password in your Google account's security settings, while signed in as the account named in Sign in as.
- Store it without spaces. It is sixteen characters. The screen warns you if a Gmail password is any other length.
- Sign in as must be the full address, not only the part before the @.
Some Google Workspace administrators turn off app passwords. If you can't create one, ask them, or ask IT for a relay.
Let people sign up
With sign-up open, somebody can create their own account from the sign-in screen by pressing Create an account. They give their name, email address and a password. Their email address becomes their username. The account only exists once they follow the link KRISID emails them. The link lasts 24 hours and works once.
Open Administration → People and Persona → Sign-up.
- Under Who may sign up, list the email domains that may sign up, separated by commas:
yourcompany.com, partner.example. A*lets in any email address at all. If you leave the box empty, nobody can sign up. A new repository starts this way. - Under What they get, choose the role a new account receives once its address is confirmed. Only roles that apply to the whole repository are offered. Viewer, which can read and not change, is the usual choice.
- Press Save.
A box at the top says either Sign-up is open. and who can join, or Sign-up is closed. and why.
Some roles can't be given this way. A role that carries ACCESS_MANAGE (it could grant roles, including to itself), VIEW_AS (it could look through other people's eyes) or PERSON_IDENTIFY (it could read everybody's username and email address) is shown greyed out, marked cannot be given on sign-up. Give those roles to people by hand, on the Assignments tab.
To give somebody more after they have signed up, assign roles on the People and Persona screen, as you would for anyone else.
Why sign-up stays closed
Every new account has to confirm its email address, so sign-up stays closed until mail can be sent. The box at the top gives the reason, for example that no domain is listed yet, or that mail is not ready. People outside only ever see that sign-up is closed, never the reason.
The rules are checked again when somebody follows their link. If you close sign-up or remove their domain in the meantime, a link that was already sent stops working.
Recent sign-ups
Recent sign-ups lists the last twenty attempts with the address, name and time, and Where it got to:
- confirmed: the account exists.
- waiting for the link to be followed: the email went out and hasn't been used.
- expired, or replaced by a newer one: they need to sign up again.
Somebody in the waiting state who tries to sign in is now told what is wrong. Giving the password they chose at sign-up gets them a message naming the inbox the email went to and telling them to open the link, rather than the sign-in screen's usual That username and password do not go together — which is accurate, because they have no account yet, and reads as "you typed your own password wrong". It is said only when the password matches, so nothing is revealed to anybody guessing. Somebody in the expired state is told to sign up again.
If somebody tells you the sign-up screen said The confirmation email could not be sent, there are now two places that say why: the failed message under What has been sent on the Email screen, with the mail server's own reply, and a trouble line in the Sign-in tab of the Logs screen naming the address and the same reply. Until this release neither was written — the record of the failure was discarded along with the attempt it described — so a sign-up that failed on mail left nothing behind to read. A closed port, a wrong password or an address the server will not relay for all now say so by name.
Good to know
- Sign-up doesn't replace invitations. You can still add people by hand and invite them. See People, roles and access.
- KRISID sends only invitations and sign-up confirmations. It sends no digests and no notifications.
- Forgotten passwords are still handled by an administrator: press Send a new link in the person's row.