Problem/Motivation
When a new user registers through OpenID Connect, no email notification is sent to the user or administrators. This contradicts Drupal's standard registration behavior, where every registration path sends appropriate emails.
The module uses ExternalAuth::register() to create user accounts, which completely bypasses Drupal's RegisterForm::submitForm() flow. As a result, _user_mail_notify() is never called, and users receive no confirmation that their registration was processed.
This affects both registration modes:
Registration Mode Email to User
REGISTER_VISITORS register_no_approval_required
REGISTER_VISITORS_ADMINISTRATIVE_APPROVAL register_pending_approval
Drupal core sends these emails in every other registration path:
- RegisterForm::submitForm() — web form registration (https://git.drupalcode.org/project/drupal/-/blob/11.x/core/modules/user/...)
- UserRegistrationResource::sendEmailNotifications() — REST registration (https://git.drupalcode.org/project/drupal/-/blob/11.x/core/modules/user/...)
Additionally, for REGISTER_VISITORS_ADMINISTRATIVE_APPROVAL, the module currently shows the message "Thank you for applying for an account. Your account is currently pending approval by the site administrator" (line 448 of OpenIDConnect.php) — but never actually sends the corresponding email. This makes the UX misleading.
Steps to reproduce
1. Configure OpenID Connect with a provider (e.g., Google)
2. Set registration to "Visitors" or "Visitors — administrator approval is required" at /admin/config/people/accounts
3. Log out and register a new account via the OpenID Connect button
4. Check the user's inbox — no email arrives
5. For admin approval mode: notice the message says the account is pending approval, but no email was actually sent to the user or administrators
Proposed resolution
In OpenIDConnect::completeAuthorization(), after creating the user account via $this->createUser(), call _user_mail_notify() with the appropriate operation based on the registration mode.
For REGISTER_VISITORS (line ~427):
case UserInterface::REGISTER_VISITORS:
try {
$account = $this->createUser($context['sub'], $context['userinfo'], $client->id());
_user_mail_notify('register_no_approval_required', $account);
}
catch (\RuntimeException $e) {
$this->messenger->addError($this->t('Account registration failed. The email address may already be in use or is invalid.'));
return FALSE;
}
break;For REGISTER_VISITORS_ADMINISTRATIVE_APPROVAL (line ~439):
case UserInterface::REGISTER_VISITORS_ADMINISTRATIVE_APPROVAL:
try {
$account = $this->createUser($context['sub'], $context['userinfo'], $client->id(), 0);
_user_mail_notify('register_pending_approval', $account);
}
catch (\RuntimeException $e) {
$this->messenger->addError($this->t('Account registration failed. The email address may already be in use or is invalid.'));
return FALSE;
}
$this->messenger->addMessage($this->t('Thank you for applying for an account. Your account is currently pending approval by the site administrator.'));
break;
This mirrors exactly what RegisterForm::submitForm() and UserRegistrationResource::sendEmailNotifications() do in Drupal core.
Workaround (for sites that need this now before the fix is merged):
Other modules can use hook_openid_connect_userinfo_save() to manually trigger the email notification:
/**
* Implements hook_openid_connect_userinfo_save().
*/
function mymodule_openid_connect_userinfo_save(UserInterface $account, array $context): void {
if (!empty($context['is_new'])) {
_user_mail_notify('register_pending_approval', $account);
}
}
Remaining tasks
- [ ] Implement the fix in OpenIDConnect::completeAuthorization()
- [ ] Add tests to verify email notifications are sent for both registration modes
- [ ] Review whether register_pending_approval_admin should also be sent to administrators
- [ ] Decide if this should be configurable (opt-in/opt-out setting)
User interface changes
None. The existing "Thank you for applying for an account..." message remains the same — the fix simply makes it accurate by ensuring the email it references is actually sent.
API changes
None. The fix uses the existing _user_mail_notify() function from Drupal core's user module.
Data model changes
None.
| Comment | File | Size | Author |
|---|---|---|---|
| #2 | openid_connect-3582680-2.patch | 1.11 KB | alekas |
Comments
Comment #2
alekas commentedAttached a patch that adds _user_mail_notify() calls in OpenIDConnect::completeAuthorization() for both registration modes, matching Drupal core's behavior in RegisterForm::submitForm() and UserRegistrationResource::sendEmailNotifications().
Tested against 3.0.0-alpha8 — email notifications are sent correctly for new user registrations via OpenID Connect.
Comment #3
steinmb commentedComment #4
dcam commentedThis issue is a partial duplicate of #3450594: No email is sent to administrator when account approval is needed which has an MR instead of a patch. Because the issues don't entirely overlap I'm going to leave this open for maintainers to decide what to do with it.