flarum / flarum/issue-archive

OAuth2 Login/Registration Flow

Open
#236 5 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

type/feature
Dominant language
No language data
Stars
0
Forks
0
PR merge metrics
No merged PRs in 30d

Description

## Bug Report

**Current Behavior**
The current behavior relies on email addresses to compare user authentication, this means that if a user uses an OAuth2 account that doesn't use the same email as a previous account that user ends up with two accounts.

**Steps to Reproduce**
1. Register an account the normal way (using one email)
2. Logout
3. Login using an OAuth2 provider that uses a different email address
4. See error

**Expected Behavior**
We should do this exactly the same way all other systems do this as described:

##### User Has Account Already (E-Mail Matches)
1. User chooses to sign in using OAuth2 for the first time
2. Server detects that the email from OAuth2 matches that of a current user
3. Server request password for the found user account
4. User enters the password correctly
5. Server connects the accounts and never request a password going forward

##### User Has Account Already (E-Mail Doesn't Match)

1. User chooses to sign in using OAuth2 for the first time
2. Server can not find a pre-existing account
3. Server displays a prompt asking if user wants to sign in using existing account or register a new one
3. User chooses to sign into account
4. User successfully enters credentials
5. server makes the association and never prompts for forum credentials again when using OAuth2

##### User Does Not Have Account

1. User chooses to sign in using OAuth2
2. Server can not find pre-existing account
3. Server displays a prompt asking if user wants to sign in using existing account or register new one
4. User chooses to register new account
5. Server request required information not provided by OAuth2
6. User completes sign up
7. Server makes association between the newly registered account and the OAuth2 provider

**Screenshots**
If applicable, add screenshots to help explain your problem.

**Environment**
- Flarum version: 0.1.0-beta.9
- Website URL: ANY flarum site (https://discuss.flarum.org)
- Webserver: [e.g. apache, nginx] ANY
- Hosting environment: [e.g. shared, vps] ANY
- PHP version: ANY
- Browser: [e.g. chrome 67, safari 11] ANY

**Possible Solution**
From my understanding from a [forum post I made](https://discuss.flarum.org/d/21014-oauth2-authentication-flow-signup-login-needs-work) the code to store additional data from OAuth2 providers has already been implemented. It should be possible to I believe that this is mostly a UI change to make this change function. I don't know exactly what needs to happen in order to make this function in the backend or for that matter if this can be done using a plugin.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Review the linked forum post and the existing OAuth2 provider data and account-association handling. Identify the UI, backend, or plugin entry points needed for matching emails, prompting for login or registration, and preserving the association; done means each listed flow connects or creates the correct account without repeated prompts.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
authentication, backend
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.