Comments (11)
Any feedback on this?
from loopback-component-passport.
from loopback-component-passport.
:beep boop:
from loopback-component-passport.
@BerkeleyTrue What did you end up doing here?
from loopback-component-passport.
I overwrote the link method on the userCredential model
UserCredential.link = UserIdentity.link.bind(UserIdentity);
A word of warning, doing this was a bad idea.
90% of our support tickets were from users who created duplicate accounts when they mistakenly used the wrong oauth. We've since made it impossible to create new accounts with all but one oauth.
from loopback-component-passport.
@BerkeleyTrue Do you mean you allow users to create accounts with email/pass OR oauth? I would think you still might end up with duplicate accounts that way, no?
In any case, I've ended up having to overhaul passport-configurator.js, partly related to the issue you encountered (though what we did was lookup if an oauth account creator had already linked to another user, and if so then we do nothing -- instead of creating a dupe account).
Though the other reason we had to overhaul is that it basically falls down when you try to use it with an iOS app. API/JSON behavior is not fully baked. Am thinking to maybe ditch/fork this module and roll my own variant modeled off of this.
from loopback-component-passport.
Problem is not all o-auth services send back an email. Also, users will create accounts on these services with different emails. You can't always rely on having enough information or the correct information to match up social o-auths. And users won't realize this and blame you for loosing their account and their data.
from loopback-component-passport.
The solution is very easy using hooks.
@ernie58 made a good solution to provide a stable sync between creds and identity:
from loopback-component-passport.
@BerkeleyTrue : Not a problem with proper flow.
When you use some social network (o-auth provider) to login and can not identify user as new or current - just make clear statement on this. If social network did not provide any email and you want to use email as user identifier - just add a step to sign-up to provide/confirm email. If user will provide email for current account, link them (maybe after some security checks). Provide ability to merge accounts based on sign-up via different o-auth providers.
Other case is when already logged-in user want to link his account with some social network. So after linking he should be able to use that social network to login into his account.
This should be not mess.
from loopback-component-passport.
just add a step to sign-up to provide/confirm email
This was considered but this adds a ton of friction for new users
So after linking he should be able to use that social network to login into his account
That was the point of this issue
from loopback-component-passport.
This was considered but this adds a ton of friction for new users
Then product designers should consider: what make more friction for users - one more step for sign-up process or merging accounts later.
IMHO, merging accounts looks better.
That was the point of this issue
Yup. For me mess with linking account in LoopBack was surprise. If user linked social network with his account - then he should be definitely able to login via social network into his account. Not a case for LoopBack. This is silly.
I m agree that sign-up based on social networks have different design patterns and different products should be able to choose flow. But framework should support that different flows: maybe some project will use sign-up stage with email confirmation after sign-up with twitter (which did not disclosure email of signed-up user), maybe other project will choose to merge accounts later. Its up to project, but framework should provide flexibility.
Not sure if my english is enough to describe my point ;)
from loopback-component-passport.
Related Issues (20)
- Cannot mix email and username to log in HOT 2
- Picking random user identity if profile.id or profile.openId is not set HOT 10
- Integration of auth by API Key / lifetime token HOT 2
- buildUserLdapProfile() patch HOT 4
- The `ApplicationCredential` instance is not valid. Details: `provider` can't be blank
- passportConfigurator.setupModels() is not working with my custom userModel. HOT 3
- options.callbackHTTPMethod can only be set to "post" or "get" HOT 2
- Missing loopback dependency HOT 6
- enable state in oauth2 HOT 3
- Does not support eternal Access Token with ttl=-1 HOT 2
- Swagger Documentation for Thirdparty auth api's for LDAP HOT 6
- when credentials are being updated, they delete the refresh token HOT 2
- Support for alternative Passport Strategies HOT 19
- How to link the same user's accounts (same email) instead of duplicating it? HOT 5
- ms-ad not getting all groups user is memberOf HOT 4
- Compatibility with loopback 4 HOT 4
- Realm is not supported when looking up existing players HOT 3
- Error 500 facebook/auth with random users HOT 2
- Passport does not work with OneLogin using the openid-connect package HOT 1
- Make sameSite cookie property configurable HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from loopback-component-passport.