I have built a web-facing tool which is mostly for internal use, but some of our clients will also make use of it. When building the registration/login parts I had a thought about who would be using it and how they would use it.
Often, there will be an account that is owned by a client, and the account will have many users, who will have varying levels of access to do things.
When a new user needs to be added to an existing account, there is a problem. I see a common situation in many other tools where an admin who is already authenticated (logged in) will have access to a "create new user" section where they can set up a new user, choose a password etc. and pass the new credentials onto the new user. This opens up more issues than I care to mention, but I'm sure anyone reading this can think of many.
I thought of the following alternatives
Admin creates the new user account and an email is sent to the new user who must then use a link in the email to set a password before the account can be used. I like this idea but a typo in the email address could give someone else access which is undesirable.
Admin creates a time-limited one-time-key which they can give to a new user. New user then enters their details on a registration form along with the OTK, which authenticates that user as being a member of the desired client/account.
The second option seems far better, the only thing being transmitted insecurely is the key which is single use and time limited, and can be redacted by the admin if necessary, but I haven't seen this method in use anywhere and wonder why.
Are there any flaws with this method that I have overlooked?
What other options have I not thought of?