Best way to add account providers?

Question

I briefly looked at spotify and I found that they use 2 providers: Themselves and facebook. Ie I can log in to spotify with facebook. But then it asks me for my spotify account when I downloaded the player and want to start the stream. Does it force me to remember a new password? I don't think it's a good feature to force users remember a new password. Soundcloud and Mixcloud work by Facebook account only and we were discussing a similar solution of how to simplify adding a provider to your service ie use case "add OAuth 2.0 provider" where optionally you may also add yourself as an OAuth provider.

Please tell me if you have any ideas about this.

Answer 1

I have experience with two sites that allow users to log on with third-party credentials:

• Trello allows users to log on with either a Google account or with a Trello account

• Stack Overflow required an OpenID account, but let you use any OpenID provider you wanted.

Over time, we implemented our own OpenID provider for Stack Exchange.

The experience has been that allowing arbitrary third-party identity providers, like Stack Exchange does, was a mistake. Third party identity providers disappear. Users forget which one they used. All users must learn about the concept of third-party authentication and usability suffers.

The Trello experience, where only Google is allowed as a third-party authentication, was entirely positive. Even novice users understood it right away, and many of them told us that they were happy to be able to "use their Google account to log on to Trello."

My recommendation would be to stick to a small, finite set of third-party authentication--probably no more than Google and maybe Facebook if your site has social implications--but still let users create passwords on your site as an alternative.