Kyrne Yes, it's definitely not only to blame on user management.
But instead of saving a random password you could set it to a vaild password before the validation check and then change it to "" afterwards.
Also same for the email, use a valid one for the validation then change it to NULL before saving. For this to work the email column needs to be NULLable.
That's what I do right now and it works fine.
Users may choose to switch to native accounts instead of SSO or use both.
For example I require users to sign up with Steam SSO but allow them to specify an email and password after they authenticated with steam:
Sign Up:
... authenticate with SSO (Steam) ...
Complete sign up:
You can't log in with an empty password ("") because it will turn into some hash "$2y$10$...." that is not equal the saved empty string ("") in the database.
For changing your E-Mail when no password is set flarum core needs to be modified so that it will return success when the password stored in the DB is an empty string ("").
If interested I can publish my changes.
In production on https://forum.gflclan.ru
