Logic Behind Social Login

Question

I have created a nice little login script for my website that lets users login with Facebook or Google at the moment.

What I am trying to do is set some checks to make sure that duplicates do not appear in the database.

Here are some scenarios I have covered :

• Login with Google/Facebook account and I have already registered this account, This will log the user straight in as they have already linked this account.
• User has already registered with Google account, yet clicks Facebook because they cannot remember which account they used. This will alert the user that the email address returned from Facebook has already been registered with a Google account. This will enable them to click on Facebook to Login ??? NOT SURE ON THIS LOGIC AT THE MOMENT ???
• User clicks on Google/Facebook to login, yet the email address returned is a user that went through the manual registration. This will alert the user that the social account they are trying to login with will require a password.

What I am thinking of doing is allowing users to LINK ACCOUNT so that the alerting process does not happen because I can link my facebook account to my google account through my website, and vice versa etc etc.

What I am asking :

Are there any other checks I may be missing? Is this logic sound? Is there anything I am doing which makes you question the login process??

Basically asking logic advice on this one.

Answer 1

Well congratulations! You're almost on the right track. Let's breakdown your situation here.

Ideal Situation

1. Registered on your site
2. Log in with Google
3. Log in with Facebook

Now, let's take the common denominator here, I mean the primary key. I am guessing in your case it should be the email address.

Actual Process Flow

1. User registers. You save the email address

Or,

2. User registers with Google/Facebook and you save the email address.

Login Procedure

1. You receive the email address either from direct login/facebook/google.
2. You match it against your table
3. On positive match, you link this social login to an existing account

If,

4. It is not a positive match then you accept whatever data you receive and then forward
   and then pass on to the registration page.

Hope this helps! Let me know if you want to know anything else.

Cheers!