Issue #6654 wontfix

Add users to a team with an invitation link (BB-10062)

Florian Gamboeck
created an issue

Hi there,

it would be great if I could add users to a Team account by sending them an invitation link by eMail which they can accept with their individual bitbucket accounts.

For example, let there be a Team account in which I want to add 50 users (or even more – why not?). I don't want to manually add those 50+ users one by one. Nobody wants that. But now imagine an invitation link that I can send around those users via a private mailing list. The users in question then can follow the link, log in with their individual accounts and accept that invitation. Wouldn't that be great?

Comments (10)

  1. Florian Gamboeck reporter

    I could imagine three options:

    1. The inviter / owner / admin of the Team account could be prompted to double check each member. But just a short prompt like "U rly sure, bro?" -> "Yes!" So quite similar to a pull request or something, where you just need to do one click to accept.
    2. The inviter could define an expiration date for such a link, like "Create a link which is valid until tomorrow, 3pm" or "valid for 48 hours".
    3. The inviter could limit the invitation to a specific domain, like "Create a link for greatcompany.org" so that just workers with an address of that company can register.

    After all, the inviter / admin can delete anyone from the Team, who hasn't been invited directly. Then it would be a nice feature if the invitation link can be revoked (so no one can register with that link anymore) and a new link can be created (if wanted, that is).

  2. Marcus Bertrand staff

    This would be a serious security concern for accounts. Having an open invite link floating around the internet for anyone to join your team and gain access to your data isn't something we're going to do.

  3. Florian Gamboeck reporter

    And what about a two-way confirmation? Bob and Mallory are following my invitation link and are both notified that I first have to approve their membership (similar to approving pull requests). They will have no access to the repositories in the meanwhile. While I approve Bob, I can still decline Mallory.

    That would be a bit complexer than my first proposal, but it's still an easier way than it is now, and there's not much risk, since after all I am the one who approves new members.

  4. Simon McCallum

    What about the invite box accepting a comma separated list of emails. That way you do not have to paste the emails in one at a time, and the system is just as secure as it is now. It just means that other people cannot share the link as there is no static link.

    I would see this also popping up a confirmation list of all the invitations that were about to be sent.

  5. Log in to comment