Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Merging OAuth account with existing account based on email address

I'm developing an MVC4/Razor site for which the client requested the ability for users to be able to sign in with Facebook/Google accounts. Fortunately, this is fairly straightforward using Forms authentication.

However, I'm faced with the issue of: what if the user's email address which is returned by the provider matches an existing username?

For example, [email protected] previously exists as a native account. For whatever reason, the user wants to use Facebook to login. Facebook returns that tim@rocketeerconsulting is the user's email address. If the user attempts to create an account using that information, MVC4 will state that the account already exists.

There are a few concerns:

  1. Should users be allowed to merge accounts if an email address provided by an OAuth provider matches an existing account?
  2. This presents a potential security risk. Can I rely on the OAuth provider to confirm that the address is valid? If not, a malicious user can create a Facebook account and then gain access to another user's account.
  3. How should such a thing be implemented, if at all?

I recognize there is a similar question here, but my question pertains specifically to the context of Forms auth in MVC4.

like image 497
Tim Ferrell Avatar asked May 27 '14 00:05

Tim Ferrell


1 Answers

You are right: it's easy to impersonate this way
Indeed, to add more to the problem, not all the OAuth providers give you the user email address (LinedId).
Every OAuth provider use an email address for initial validation, however, the user can have more than one, indeed some encurages you have them as backup.
So the email is not a good 'key' to identify the user.
Probably your solution will be to have a table with your own internal id and the relate this to the OAuth provider unique user identification: some use the email address, others screen name or similar.
This will allow the user to have more than one OAuth validator on your site. I implemented this with: Linkedin, Twitter, Amazon, Google+, Microsoft and Facebook.
Additionaly, our users can use their domain account to login, but this is another story...

like image 196
fcm Avatar answered Oct 23 '22 18:10

fcm