ory / ory/network

Presented with a prompt to link account using password when pre-existing account does not use password auth method

Open
#400 7 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Shell
Stars
96
Forks
8
PR merge metrics
No merged PRs in 30d

Description

Preflight checklist
Ory Network Project

https://interesting-mcnulty-i7fnu6z46n.projects.oryapis.com

Describe the bug

When trying to sign-in with SSO, I am presented with a prompt to link my account using a password even though my pre-existing account does not use the password auth method

Steps to reproduce:

  1. Setup Enterprise SSO connection and via self-service registration, create an account that is managed by the SSO organisation.
  2. Remove the Google OIDC connection for my Enterprise SSO organisation
  3. On the same organisation, setup a new Google OIDC connection
  4. The OIDC connection now has a different redirect URI
  5. Try to sign in with SSO
  6. Run into this prompt asking me to link my account by providing a password
  7. Can't provide a password because my account has no password auth method (only the outdated OIDC auth method)
  8. Therefore, can't link account and so can't login using the new OIDC connection
    Screenshot 2024-11-14 at 10 40 43
Reproducing the bug

Follow steps described in the previous section

Relevant log output

No response

Relevant configuration

No response

Version

Ory Network

On which operating system are you observing this issue?

macOS

In which environment are you deploying?

Ory Network

Additional Context

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the six-step SSO and Google OIDC connection replacement flow described in the issue, including an account with only the outdated OIDC auth method. Trace the account-linking prompt and determine how it handles accounts without password authentication; done means the new OIDC connection can be used without requiring an unavailable password.

Written by the indexing model from the issue text.

Assessment

Domain
authentication
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.