dotnet / dotnet/aspnetcore

Improvement for external provider flow when user already has local account

Open
#5,750 1 comment 0 reactions 0 assignees View on GitHub
affected-medium area-identity enhancement severity-minor
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 10h
Merged PRs (30d)
281

Description

Hi:

I am testing the case where a user creates a local account (e.g., test@gmail.com) and comes back to the site a time after and does not remember if it created a local account or used a external provider (e.g., Google), so it decides to attempt to login with its Google account; or simply, a user that does not remember its password and he hates the password recovery process so it decides to attempt to login with its Google account.

In such scenario, when the user attempts to login with Google, it gets to /Account/ExternalLoginCallback , which shows "Register", "Associate your Google account", "You've successfully authenticated with Google".

When the user clicks Register button, without changing its email test@gmail.com, it gets the error message "User name 'test@gmail.com' is already taken", and the message "You've successfully authenticated with" [which LACKS the provider name Google ].

(to solve this small issue, instead of persisting the LoginProvider in ViewData I included it in ExternalLoginConfirmationViewModel and used a input/hiiden in the form)

I believe this flow is not appropriate for this case because obviosly this user does not want to Register, so I think that when a user coming from an external provider attemps to login for the first time (that it seems to be registering to the service), the system should verify if the email account is already taken because in such case there is a high probability that the user is not attempting to create another account in the system but to login to its account. So, if taken, there should be a different flow that helps the user link the external provider to its account, or at least give options :

Do you want to create a new account OR link your "Google" account to the existing account for test@gmail.com?

Hope this helps improve the system.

Thanks

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.