Auth0 database and social connections, unique email addresses

4
votes

Maybe I am missing something here, or this is a flaw in Auth0? I'll give an example of my issue:

Let's say I have my Default App (client), hooked up to that I have Username-Password-Authentication (database connection) and google-oauth2 (social connection).

A user comes to my site, signs up via google-oauth2 (social connection) using [email protected]. Once complete, he gets added to my users in Auth0, all great.

A few months later, Joe comes back to my site, and being a busy guy, he forgets he signed up to my site before. This time, he decides to sign up using my custom Email and Password form, that will add the user to the Username-Password-Authentication (database connection). so he signs up there using [email protected] again, and everything goes well, he is now listed in my user's section in my Auth0 dashboard.

This is the problem, I now have two [email protected] accounts, one with google-outh2 and one with Username-Password-Authentication. I really can't have this, I need a unique email address, regardless of the ID Auth0 supplies.

Does anyone know how I can make email address in my user section 100% unique? I'd think a rule would do this, but it appears rules only apply AFTER a user has been registered, so I can't run a rule before adding?

the only way I can see doing this right now is make my own checks and delete via the management API, but that is a really long and messy way to do it I feel.

Any help will be appreciated here!

Thanks!

2
auth0

2 Answers

1
votes

Auth0's default behavior is to create a new account in the database for every unique entry. Since the user created using Google has a unique id (based on google-oauth2), and the user created using the sign-up form has a unique id - they will technically be considered two separate accounts. In order to resolve this disparity, you can establish a means with which the account data can be merged. In the documentation linked provided above, there are examples of three possible ways of doing this:

  1. Automatic Linking - which involves creating a specific rule to merge users based on matching emails
  2. User-Initiated Linking - which involves providing a UI for users to opt into merging users with matching emails
  3. Suggested Account Linking - which involves setting up a rule that is linked into the UI

One important thing to consider is that the data returned from different social identity providers may not be normalized the way that data is normalized onto the Username-Password-Database. For example, while auth0's default for emails is to lowercase the information, google-oauth2 may return emails as Uppercased - creating the potential for non-matching emails when checks are made using strict equality

0
votes

The option you are looking for is called account linking. You can find more info at https://auth0.com/docs/link-accounts