could this be an alternative to email registration?

> How will you tell your 700 users what their (initial) password is without having their email addresses?

Print them out on a slip of paper and hand them to the students during an IT class.

> how it basically only defers the password asking from one website (where you want to log in) to
> another (where you hold your openid)

I was hoping that if I was 'my own openID provider', there would be a database somewhere with the students' allocated openID (eg. name@ourdomain.net) and a password, without them needing an external email address.

> Visitors can create accounts and no administrator approval is required.

For all of the different registration settings in D6, a unique email address is required. Even if you switch off email authentication, although drupal doesn't send the user an email, the user is *still* required to fill out the email field.

The only workaround that I can think of at the moment is so ugly that it doesn't bear contemplating: turn off registration completely; ask the children to request an account verbally; create the accounts myself, supplying an email address in the registration field such as: name@disposable-domain.net; then black-hole all mail sent and received on that domain; and disable all user contact forms until someone builds an internal messaging system for D6. Yuk.

Note that, I do not wish to create real email addresses for each student at our school domain. It would take far too long, be very difficult to manage, and would introduce the possibility of young children being targeted by inappropriate spam and other unwanted contacts.

I just don't understand why these CMS's are so insistent on obtaining an email address. If we want users just to register with name and password, and moderate the account creation ourselves, it shouldn't be hard to do. Email registration sucks anyway! What kind of identification or assurance does email give? None! It's so stupid.

> Slightly of topic, I would never run a site for 700 users on a server that has so many limitations

Really? It's a normal business account - quite fast, 8gb, excellent support and reliability, and a fairly decent price. But like all shared servers, the only thing you can't have is root access. And to be honest, I wouldn't know what to do with root access if I had it - it looks extremely difficult to install an LDAP server, for instance.

Apart from that, I didn't think 700 users was large at all - only a max of about 250 would use it at any given moment, and usually a lot less - maybe 50 - 100 simultaneous users. We sure as hell can't afford a dedicated server or reseller account.

As suggested, OpenID doesn't really seem appropriate for the purpose.
To run an openID server, you need a VPS account or equivalent.
And if you have that, running an LDAP server for authentication is probably more appropriate/useful.

However, there is some progress being made with regard to registering without providing an email - a module; a script for template.php; and a patch to core, are all currently being worked on within separate forum threads.

The biggest problem is that, whichever of these approaches is used, turning email off causes problems with any module which assumes email addresses are supplied, does not check for a null or false string, and so crashes or produces errors when the module tries to use the address. This actually includes the core 'contact' module!

As I understand it, the only solution to these problems is that module developers need to check whether an email exists rather than assume it exists, especially as there are already two or three existing 'user management' and 'import' modules which create user accounts without creating an email address. I would've thought checking for a null string was good practice anyway.

> its the ONLY way to allow users to reset passwords

Not if they were asked for a secret pass phrase or security question on registration. Then they could enter that to gain access to their account if they forgot their password.

> to send them updates if needed

We can always use simplenews if users want to receive info by email. Internal private messaging is also an option for those without email. It is arguably less reliable than email, as the user needs to visit the site to get the information, but after sending email you never know whether the user checks and reads the email they supplied anyway!