EDIT

Andreas Müller wrote:

As password recovery is not necessarily a feature needed for all CDM instances the necessity of obligatory email needs to be discussed.
Disadvantage is that sometimes a valid email is not yet known at times when a user account is created.

Maybe we could require it only for user creation via browser (vaadin) and implement validation via user interface.

Password recovery will be a functionality offered by a service class and the according web service controller. These components may only be needed for specific cdm instances and could therefore be made optional (enable via spring profile?)
An other point to take into consideration is that instances enabled password recovery will also allow self registration (sign in) of new users. In self registration workflows usually a confirmation email is sent to the user.

Suggestion:

Self registration and password recovery will be provided by spring service beans and web service controllers which are only active in a specific spring profile (user-self-registration). The profile can be enabled per cdm instance, that is the spring profiles to be enabled must be defined in a configuration file per instance. Enabling this profile will activate a bean which makes email addresses mandatory.

i am removing the last comment as this was misplaced here. This comment is a duplicate of #7276#note-11

in #7276#note-11 we decided for the strategy to adding default dummy-email addresses to replace null values.