Users adding themselves to Glip

Question

question

keith-lazarus13798 asked Sep 20, '19 keith-lazarus13798 commented Sep 23, '19

Users adding themselves to Glip

I had an interesting experience the other day with a user that was new to our organization came into my office, saying that I should check the security settings of our Glip site because he was able to create his own account and "Get in".

This caused me a bit of panic until I discovered the following:

Because his e-mail was associated with the same domain as mine, when he created his ID, Glip recognized that we already had a Glip instance configured and it added him to it. To its credit, Glip confirms the user's "legitimacy" by making them click on a link in an e-mail that gets sent to their supplied address before activating the account.
While he was able to get in, he was able to get into the "Organization-wide" team, but none of the individual teams that we had configured.
He was able to see/IM others in the organization.

I suppose it could be argued that this is a great feature that simplifies administration/rollout of the product but I don't really believe that - I can think of many scenarios where organizations might want to restrict who is allowed to use the app.

Has anybody else stumbled across this "feature"? What are your thoughts?

I'd be particularly interested in hearing RingCentral's position on this.

ringcentral app

1 |3000

Attachments: Up to 8 attachments (including images) can be used with a maximum of 1.0 MiB each and 10.0 MiB total.

Work together.
From anywhere.

Team messaging, video meetings
and phone - all in one app.

Get the new RingCentral app

Answer 1 · 2019-09-20T16:46:31Z

cglassy3135 answered Sep 20, '19

USA-based acct | 2287 Users | 3800 DID lines | 28 sites | all Polycom VVX500 phone handsets

2019-09-20 This was one of the reasons we banned use of Glip in our organization, due to lack of Enterprise level security controls on who can add themselves, who can create teams, who can message to all users without any moderation whatsoever.

Join our unofficial RingCentral Admins User Group
http://ringcentraladminusersgroup.org/index.html

1 |3000

Attachments: Up to 8 attachments (including images) can be used with a maximum of 1.0 MiB each and 10.0 MiB total.

Answer 2 · 2019-09-20T17:33:31Z

keith-lazarus13798 answered Sep 20, '19

I should have mentioned in my original post that, worst of all, as an administrator, I don't get any notification that the user has added themselves so that I can either address the issue, or add the users to to the appropriate teams.

1 |3000

Attachments: Up to 8 attachments (including images) can be used with a maximum of 1.0 MiB each and 10.0 MiB total.

Answer 3 · 2019-09-23T12:56:26Z

mark-bartoszek11103 answered Sep 23, '19 keith-lazarus13798 commented Sep 23, '19

I don't quite understand the situation here. Did he or did he not have a RC account? If he did, then it's understandable why he was able to log into Glip. Are you trying to restrict RC users from accessing Glip unless you let them?

3

1 |3000

Attachments: Up to 8 attachments (including images) can be used with a maximum of 1.0 MiB each and 10.0 MiB total.

mark-bartoszek11103 commented · Sep 23, 2019 at 06:49 PM

Got it! Upon further review of the Administration settings in Glip, there is a setting that allows employees to sign up without being invited. I would turn that off if you don't want users to add themselves. I'm actually going to do that myself. It's strange that it would be turned on by default.

1 ·

keith-lazarus13798 commented · Sep 23, 2019 at 06:39 PM

No - he didn't have a RC account - not to begin with. He simply went to the RC/Glip website, selected "Create new user", entered his details with an email address corresponding to our domain, and he became part of our Glip instance.

0 ·

keith-lazarus13798 commented · Sep 23, 2019 at 07:31 PM

Mark, Thank you very much for posting that. Interestingly, I'm not seeing it either in the Admin settings on my Glip client or my Glip web accounts. I'm *guessing* that it's only there in the paid version (we're in the process of transitioning to that).

I'll update my original post once I've gotten to the bottom of why I'm not seeing it.

Thanks again!

0 ·

question