Even if you set auth.require-email-verification to false and a new user authenticates using Google Apps (restricted to a specific single domain), email verification is still required.
Description
Description
Event Timeline
Comment Actions
It is expected that auth.email-domains will always require verification. This is documented in the configuration for auth.email-domains:
If you configure this, it implies auth.require-email-verification.
If we don't do this, a minor bug in a third-party provider (where you can trick it into telling Phabricator you own an email address you don't actually own) becomes a severe security vulnerability in Phabricator (where an attacker can exploit the bug to register an account).