Signups forbidden when not signing up via /admin

I’m using orion together with meteor-accounts-ui-bootstrap-3, and even though I’ve configured it so account creation is permitted via Options.set('forbidClientAccountCreation', false);, I can’t sign up using the accounts-ui-bootstrap functionality. I am getting a “Signups forbidden” message in the GUI, but no errors in client/server console. I can still sign up new users via the orion /admin page.

I can’t be sure if this is an orion issue or an issue with the accounts ui package, so I’ve also created an issue in the accounts-ui-bootstrap-3 repo, here.

I’ve set up a minimal example that reproduces the issue: https://github.com/Madsn/testingorion

[sean-stanley]

Just in case anyone else finds this issue and removing accounts-ui did not resolve the issue. Make sure to call Options.set('forbidClientAccountCreation', false); in common code not client only code. I ran mine in client/admin/options.js and no result but moving the file to lib/options.js suddenly allowed me to create users locally again.

[swhamilton]

@Madsn I have figured out a workaround that was not mentioned, but I am unsure if this new approach is a security hole. I will need others to help give insight here as I have limited Meteor experience.

Following the basic project here demonstrating the issue: https://github.com/Madsn/testingorion

I added the following lines in your testingorion.js file. Note BOTH client and server needed to be changed:

// Hack to force forbidClientAccountCreation option to false.
 if (Meteor.isServer) {
    Accounts._options.forbidClientAccountCreation = false;
 }

 if (Meteor.isClient) {
    Accounts.config({
        forbidClientAccountCreation: false
    });
 }

I don’t like setting the Accounts _option this way (without using a setter), but I couldn’t figure out a better way that worked. Perhaps this hack could lead to finding the real issue and solving it. It seems the issue is either the client, the server, or both are not properly setting the forbidClientAccountCreation to false, and I believe if one is false, it will not allow client account creation.

I also tried a bunch of different approaches to fixing this issue:

// None of these setters changed the forbidClientAccountCreation to be false:
 if (Meteor.isServer) {
    Options.set('forbidClientAccountCreation', false);

    Accounts.config({
        forbidClientAccountCreation: false
    });

    AccountsTemplates.options.forbidClientAccountCreation = false;

    orion.accounts.addProtectedRoute('home');
}

Any help from the community would be great to figure this one out and suggest something better than my probably bad solution.