Asking for a username and password when a user signed-up with social login buttons

Question

I have a social application that allows users to sign up with their social accounts. The problem is that when a user uses a social login button to sign up in my website, the only way to login next time is to use the same button. I mean the classic login section that asks username and password doesn't make sense for him/her anymore.

I know that users use social login buttons to avoid extra work but in my experience many users who signed up with their social accounts try to use classic user login section next time and after a few failed attempt, they realize that they signed up using a social login button.

The question is that should I force users to enter their missing credentials like password and username to be able to login using classic login section next time?

Answer 1

The whole point of social logins is

• to make it easier to log in
• to ensure that users do NOT have to remember a lot of different username / passwords
• to ensure that to avoid remember all those different ones, they would use the same ones on different sites creating a security risk for themselves
• but most importantly: that they don't have to trust you to keep their credentials save because you don't even have them.

So asking for them after a social login completely defeats the object of the exercise. Instead of displaying just a "user/password combination invalid" add a hint asking whether they maybe registered with one of the social logins.

Answer 2

In one word, no. Users have used the social login to make it easier and asking for the same info again defeats the purpose.

There are two options:

1. Simplify your register form to be just email and password, have strong logic to deal with mistakes and get rid of the social login.

2. Advise the user if they try to use their social media login details on the site login form, something along the lines of 'We found this email associated with a social media login, did you sign up with ...'.

Also, make sure your social logins are availbale on the login page (clearly distinct of course, but easily accessible and clear).

On final note: If you have a login form that checks against a password in the database and the email address is populated by social login, do ensure that the password field that normal site login uses is populated with something random, otherwise the accounts might not be secure.