New user activation by admin after registration

The Basics

  • Nextcloud Server version ( 31.0.5):

  • Operating system and version (Debian 12):

  • Web server and version (e.g, Apache 2.4.25):

  • No Reverse proxy

  • PHP version (8.2):

  • Is this the first time you’ve seen this error? (Yes):

  • Installation method (Bare Metal)

Summary of the issue you are facing:

I would like new users to be able to register. I use the “registration” application, but there’s a problem. Anyone can register and that’s not what I want.

On an older version of nextcloud I’d managed to set up a registration system that allowed the admin to receive notification of a new user and then activate it or not. (but I lost this machine after a data crash)

I can’t find this feature on this version and the registration application doesn’t have it.

What can I do to :

  • have a user register himself
  • confirm their email address
  • admin receive a notification of new user registration
  • the admin has the choice of activating this user or not.

I have traces of emails sent to the admin to activate newly registered users. The activation URL was: /index.php/settings/users/disabled

I can’t find this feature even after searching. What happened with this?

Hi, would the “Allow-list with email domains” function work for your needs? Could you tell us more about what you’re trying to achieve?

Maybe you can use the normal app Registration and use the app Custom CSS to hide the button Register on the Nextcloud start page. Then you can post the user the link https://cloud.server.tld/index.php/apps/registration and hopefully no other user test the link.

Maybe someone can find the needed code for the app Custom CSS. Thanks.

It’ simple :

I would like any new user registration to be validated by an admin before they can log in.

In other words, admins must activate the account of a newly registered user. Before my server crashed, the procedure was as follows:

  • Anyone can register
  • Each new user receives an email validating their registration but specifying that their account must be validated by an admin.
  • At the same time, each admin receives an email informing them of the new user registration with a button to activate that user’s account (see capture of an old email from 11/2024).
  • When the admin activates the account…
  • …the new user receives an email confirming that their account is active and he can login to Nextcloud.

This procedure existed on Nextcloud at the end of 2024, but I can’t get it back in place today.

I haven’t changed anything in the Nextcloud code or any app. This registration procedure was already available “out of the box”.

here the mail received by admins to enable new registered users :

Dear @Clarte

Thank you for the information. To better understand the scope, I’d appreciate clarification on the following:

  1. Public Cloud Access

    • Is this a public cloud service available to anyone, or is it restricted to company use?
  2. Expected User Base

    • How many users are currently planned for this system?
  3. Definition of “Anyone”

    • Could you clarify who falls under “anyone”? (e.g., general public, registered users, specific organizations)
  4. Email Usage

    • Will users be allowed to register with both personal (private) and business (corporate) email addresses?

Looking forward to your response :slight_smile:

It restricted inter companies use. We don’t know in advance who will register and that’s why we need to review new account before enable it.

There is approximately 100 users who need to register on this server. Anyone means, as I said before, any user who is involved in this project and they are free to use the email address of their choice.

But because this registration provides direct access to research resources, we can’t give a direct use to new registered users.

As far as I can see from this link:

the app enables controlled user registration. I’ve installed the tool and can see it on my end. See image:

In the screenshot you can see two important features:

  1. “Require administrator approval” - this means every new registration must first be approved by the admin
  2. The ability to automatically assign new users to a specific group

This means you can configure Nextcloud so that new users land in a “Restricted Users” group that initially has no access to sensitive data. Since the app also sends admin notifications, this can be handled relatively quickly for 100 people - not super elegant, but a functional and secure solution.

Alternatively, you could collect all interested company users, sending a form or a newsletter, with their known email addresses from the company ERP and then import them directly into Nextcloud via CSV import or similar tools. That would probably be the fastest, and maybe more secure, way for the initial setup.

This worked very smooth for me:

For an organization with 100+ people, I would definitely see security as the top priority. You shouldn’t cut corners on security to save time or effort - better to set it up properly once than to have problems later.

register.pdf (104.8 KB)

In the very worst case scenario, a malicious user in a restricted group could:

  • Gain access to all files shared with this group.
  • Be overlooked by the admin and have access for a long time without being noticed.
  • Collect internal information for phishing attacks.
  • Attempt to obtain higher privileges.
  • Misuse storage space/resources.
  • Deceive other users or spread malware.

Therefore: Even ‘restricted’ groups should only be accessible to verified employees. Admin approval really makes sense here!

PS: These are theoretical scenarios – very unlikely in practice with a good configuration, but again, better to set up securely from the start. :blush:

@Clarte Hi, any Feedback?