Presented with a prompt to link account using password when pre-existing account does not use password auth method
Nobody has claimed this yet.
- Dominant language
- Shell
- Stars
- 96
- Forks
- 8
- PR merge metrics
- No merged PRs in 30d
Description
Preflight checklist
- I could not find a solution in the existing issues, docs, nor discussions.
- I agree to follow this project's Code of Conduct.
- I have read and am following this repository's Contribution Guidelines.
- I have joined the Ory Community Slack.
- I am signed up to the Ory Security Patch Newsletter.
Ory Network Project
https://interesting-mcnulty-i7fnu6z46n.projects.oryapis.com
Describe the bug
When trying to sign-in with SSO, I am presented with a prompt to link my account using a password even though my pre-existing account does not use the password auth method
Steps to reproduce:
- Setup Enterprise SSO connection and via self-service registration, create an account that is managed by the SSO organisation.
- Remove the Google OIDC connection for my Enterprise SSO organisation
- On the same organisation, setup a new Google OIDC connection
- The OIDC connection now has a different redirect URI
- Try to sign in with SSO
- Run into this prompt asking me to link my account by providing a password
- Can't provide a password because my account has no password auth method (only the outdated OIDC auth method)
- Therefore, can't link account and so can't login using the new OIDC connection
Reproducing the bug
Follow steps described in the previous section
Relevant log output
No response
Relevant configuration
No response
Version
Ory Network
On which operating system are you observing this issue?
macOS
In which environment are you deploying?
Ory Network
Additional Context
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the six-step SSO and Google OIDC connection replacement flow described in the issue, including an account with only the outdated OIDC auth method. Trace the account-linking prompt and determine how it handles accounts without password authentication; done means the new OIDC connection can be used without requiring an unavailable password.
Written by the indexing model from the issue text.
Assessment
- Domain
- authentication
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100