Hmm, I think you are missing the point. Our customers (the organisations) are very well-known to us. The individual users within those organisations are not. We are contractually committed to give support to ANY user from within our customer's organisations. For some of our customers there are literally hundreds of users that we serve within a single customer organisation. We would kill ourselves if we were to set up customer users on a person-by-person basis. And it would probably infuriate our customers to wait for us to do so every time.
There's no way that our customers would hand out anything that looks like a user registry, e.g LDAP or similar. These are well-guarded secrets that cannot even be offered to the government unless required to by law. Corporations treat even the usernames that they use internally as well-guarded secrets that are not to leave the doorstep of the organisation. (the idea is that knowing internal user names within a corporation moves a potential hacker one step closer to his target).
This may all sound as if I cannot use your answer. Far from it. I can use the CAPTCHA idea and will look into it.
Thank you.
Brian
________________________________
From: Gerald Young
Maybe I'm thick but I cannot figure this one out:
I really like the self-registration feature. The idea is that our customers should be able to self serve as much as possible. However at the moment anyone can register and I fear that when we go live there will be lots of self-registration attempts by spammers.
In the company I work for the customer organizations are well-known (a dozen or so). The users within them are not (several hundreds).
What I would like is that only users (customers) who register with e-mail domains that are known to the OTRS system are allowed to self-register on the portal. Example : We would allow john.doe@ikea.com to self-register because IKEA is a customer of ours and thus "@ikea.com" is a well-known e-mail domain. Conversely if joe.hacker@harmful.com tries to register he should be rejected. (IKEA is not really a customer of ours in real world :-))
Having the above functionality would of course require that OTRS would store a list of known e-mail domains for each customer organization.
But, but. There may be other ways to prevent misuse of the self-registration feature. Perhaps some functionality that already exist? Any ideas ?
Thx.
Brian
--------------------------------------------------------------------- OTRS mailing list: otrs - Webpage: http://otrs.org/ Archive: http://lists.otrs.org/pipermail/otrs To unsubscribe: http://lists.otrs.org/cgi-bin/listinfo/otrs