Changes to the user invite system

In short: You can now immediately add known users to your site, rather than inviting them to join. The people you add will receive an email informing them they have been added. No further action is necessary for either party.

Earlier this year we migrated to use Shibboleth as as our authentication protocol across our WordPress platforms (Blogs, CMS, CTLT Events, H5P Open Hub). With that change came an irregular, hard-to-reproduce, but very annoying bug for some of our users. The bug surfaced when someone tried to accept an invite via clicking on the link in the email they received after someone invited them to join their site. The invitee got stuck in a redirect loop and could never accept the invite.

After quite a lot of investigation, we determined that the issue was caused by a clash in some people’s browser cookies. Asking everyone to clear their cookies every time they received an invite, and handling an increased support load, is something we would rather avoid.

Additionally, the invite system itself, is a decade old. It was time to evaluate the way in which people added others to their sites.

Opting In

If you’ve ever signed up for an email newsletter you’ll be aware of the double opt-in method. You put your email address in a box, receive an email, and have a button to click to confirm you want to be added to the mailing list you just signed up for. This is useful to prevent spam – someone can’t just randomly add you to a newsletter.

For the last decade this is the method we’ve used when inviting someone to a site. A user who is already an administrator of a site can invite somebody to be a user on that site then they would have to accept that invitation they received via email.

The thought process at the time was that this is similar to newsletter signup. We wanted to ensure that someone being added to a site had the opportunity to decline it and couldn’t just be added to a site at random.

Opting Out

Upon looking at how folks use the user invite system, and on taking stock of the users we have on our platforms, and the people they are inviting to their sites, we realized that this model perhaps wasn’t working the way we envisaged.

Administrators on sites are trusted users. One of those administrators isn’t going to randomly add a bunch of people — people who already have accounts on that platform themselves — to be users on a site they already administer in some sort of mass spam sign up. That doesn’t really make any sense logically, and it simply never happened.

However, the invite system added a barrier. It required 2 people to coordinate, act, wait, and eventually confirm, to perform an action. That barrier is unnecessary especially in the scenario where both of them are trusted users, AND there is a record attached to the CWL of a user who is doing the invite in the first place.

It is time to remove that unnecessary barrier. We have adjusted the way you can add users on sites upon which you have the administrator role.

Users can still remove themselves from a site, that process has no changed.

Adding Users vs Inviting Users

As an administrator of a site you will still visit the same screen in your dashboard – Users > Invite User. We haven’t changed that ‘name’ as we wanted to provide as consistent approach as possible. The screen itself still looks very similar. There’s a new notification up top (that I’m sure all of you will 100% completely read) which lets you know of the change.

The main change here is that when you add someone’s email address in the box up top, and choose a role, you’re now immediately adding that user to your site (as long as they already have a CMS account – that restriction hasn’t changed). The person you have added, rather than receiving an email to accept the invite, will now receive an email informing them that they have been added to the site at the role you chose when you added them.

This now provides a more seamless approach for everyone involved.

We’ll continue to monitor the invite system, and encourage you to contact us should you have any suggestions or improvements.

This new system is in place on both UBC CMS and UBC Blogs.