Insight

Fixing the “Account is Pending Email Confirmation” Error in Moodle Google SSO

· 3 min read · 91 views

If your institution uses Google Workspace (OAuth 2) for Single Sign-On (SSO) in Moodle, you might occasionally encounter a frustrating issue where existing users—who have successfully logged in for years—are suddenly blocked with the message:
“The account is pending email confirmation”

When this occurs, the user is redirected back to the login screen (/login/index.php) and cannot access their dashboard, even though Google Workspace accounts are already authenticated and verified by default.

Here is a breakdown of why this happens in Moodle and the step-by-step fix to resolve it for affected users and prevent it from recurring.

Why This Error Happens

Even when using external identity providers like Google Workspace, Moodle maintains its own internal database records (mdl_user and mdl_auth_oauth2_linked_login).
This error is typically triggered by one of three scenarios:
  1. OAuth 2 Email Verification Enabled: Moodle has a setting in the OAuth 2 configuration called Require email verification. If checked, Moodle attempts to send its own confirmation email to the user upon login, ignoring the fact that Google has already verified the account.
  2. Flagged Database Record (confirmed = 0): If a login attempt fails midway, or if a user profile change occurs (e.g., an updated email address or domain alias), Moodle creates or updates the user record with confirmed = 0 and generates a temporary secret token.
  3. Stuck OAuth Mapping: Moodle creates a linkage entry in mdl_auth_oauth2_linked_login. If this entry becomes corrupted or orphaned during a failed session, Moodle continuously drops the user into an unconfirmed state during subsequent login attempts.

Step-By-Step Solution

To resolve this issue completely, you need to update your global OAuth settings and clean up the affected records in the Moodle database.

Step 1: Disable “Require Email Verification” in Moodle

First, ensure Moodle does not try to re-verify domain-authenticated Google accounts:
  1. Log in to Moodle as an Administrator.
  2. Navigate to Site administration -> Server -> OAuth 2 services, depending on your Moodle version.
  3. Click the Edit (Gear icon) next to your Google Workspace service configuration.
  4. Uncheck Require email verification.
  5. Check I understand that disabling email verification can be a security issue.
  6. Save changes.

Step 2: Fix Affected Users in the Database

Unchecking the setting prevents future occurrences, but it will not retroactively fix accounts already stuck in the unconfirmed state. You must manually update those records in MySQL/MariaDB.

Fixing a Specific User

Run the following SQL queries for any lecturer or student stuck in the loop (replace lecturer@domain.ac.ug with their actual email):
SQL
-- 1. Mark the user account as fully confirmed
UPDATE mdl_user 
SET confirmed = 1 
WHERE email = 'lecturer@domain.ac.ug';

-- 2. Clear lingering confirmation secrets
UPDATE mdl_user 
SET secret = '' 
WHERE email = 'lecturer@domain.ac.ug';

-- 3. Clear orphaned/stuck OAuth2 linkage entries
DELETE FROM mdl_auth_oauth2_linked_login 
WHERE email = 'lecturer@domain.ac.ug';

Mass Cleanup (Optional)

If multiple users are facing this issue across your LMS, you can run a bulk cleanup query:
SQL
-- Confirm all active, non-deleted user accounts currently marked unconfirmed
UPDATE mdl_user 
SET confirmed = 1, secret = '' 
WHERE deleted = 0 AND suspended = 0 AND confirmed = 0;

-- Delete orphaned OAuth2 mapping records
DELETE FROM mdl_auth_oauth2_linked_login 
WHERE userid NOT IN (SELECT id FROM mdl_user);

Step 3: Purge Moodle Caches

After executing the database updates, clear Moodle’s caches so the changes take effect immediately:
  • Via Command Line (Recommended):
    Bash
    php admin/cli/purge_caches.php
  • Via Web GUI:
    Go to Site administration ->Development -> Purge caches and click Purge all caches.

    Summary

When implementing Google Workspace SSO on Moodle, external email verification should always be disabled within the OAuth 2 service settings. If users get trapped in the “pending email confirmation” loop before that setting is turned off, updating confirmed = 1 and clearing secret and mdl_auth_oauth2_linked_login entries in the database will instantly restore their access.
Views: 91