OAuth and email addresses

This is an open forum for any mojoPortal topics that don't fall into the other categories.

This thread is closed to new posts. You must sign in to post in the forums.
5/24/2013 2:39:07 AM
Gravatar
Total Posts 7

OAuth and email addresses

In our scenario, we need to confirm email addresses for users. We also want to support OAuth to simplify login. The mojoPortal integration with Janrain is easy to set up and works great. Ideally we could just trust that the emails we receive during OAuth have already been confirmed, which also saves us the issue of matching the email they log in with somewhere else and the email they're registered with on our site. For example, if I create an account using user@email.com with a local password, but then later on decide to log in with Facebook or Live ID using user@email.com, it recognizes the existing account and logs me beautifully.

Unfortunately, some OAuth providers (Twitter and LinkedIn, at least) don't provide email addresses, so there's no way to perform this link automatically, so mojoPortal reasonably asks the user to provide an email while completing registration. That puts us in an odd situation where an account may have been previously created for user@email.com, but when they OAuth in via their Twitter for user@email.com, it asks them to complete registration for a new account and gives an error if they try to use user@email.com due to the previous account. There isn't really a clean way to associate those providers with an existing account, as far as we can tell.

It seems like there's really no way around this, so we're just better off not supporting Twitter, LinkedIn, and any other provider that doesn't include email. However, I was hoping someone else might have come across an elegant solution to this issue.

5/24/2013 11:28:44 AM
Gravatar
Total Posts 18439

Re: OAuth and email addresses

Hi Ed,

Yes it is a difficult problem. For a new site one could disable Database Authentication and only use Janrain to prevent such collisions. Of course the collision could still happen again if the user suddenly decides to use a different provider ie switch from twitter to linkedin but using the same email.

A savvy user could also work around the problem by making his email unique, ie most email accounts support a syntax where you can add an extension to the email like if my email is fredsmith@gmail.com I could put fredsmtih+mojoportal@gmail.com to avoid the conflict with my previous account. I would still receive the email to this address. People often use this mechanism for mailbox rules to route messages from particular sites into folders. 

Best,

Joe

You must sign in to post in the forums. This thread is closed to new posts.