I have a site that allows logging in through:
- Email (must be verified and unique)
Once you have created an account through one of those 4 methods, I provide the ability to link additional accounts. However, if you have signed up through email, then attempt to login through facebook, I check to see if the email returned from facebook already exists in the system. If the email is already associated to a verified account, I simply link the account and log them in.
I think of this as a convenient method to login and have tried to think of security, privacy and inconvenience issues that could present themselves, but haven't been able to think of any. I could perhaps see people thinking of their facebook account as distinct and not as an email address then maybe being confused as to why their account got associated to their existing account.
I have read this thread, but it seems to be a slightly different question since they are dealing with unique usernames, not emails. Are there security issues I might not be thinking of? I have looked at other sites as an example and it seems to be varied as to what they implement, though there are quite a few sites that will create an SEPERATE account for you if login with social, ie: I had an existing account created using x, then signed up with facebook and it's treated as a separate account.
Is there something I might not be thinking of from a UX standpoint that would necessitate me not linking the accounts automatically?
- A User signs up with email/password
- A User verifies email. Can now login.
- A User can link social accounts on their profile.
- A User can sign up with social.
- A User can sign in immediately, there is no verification.
- A user can link other accounts & set a password on their profile.
- If a user already has an existing account, and attempt to login through a social method
- If there is a matching verified email address, the account is linked and the user is signed in. There is an informational message letting the user know.
- If there is no matching email address, a new unique account is created.