Sign up for a company network with LinkedIn using a deleted account

Question

My question concerns the sign-up flow for a user joining a company network. The case is as follows:

An ex-employee has a LinkedIn account with a company email address([email protected]). He tries to signup for a company network via LinkedIn. Now in this case we can never be sure if a user signing up via LinkedIn has a functional company account or not and so we'll have to verify his email-id which kind of defeats the purpose of sign up with LinkedIn. If we don't verify his email-id, we risk an ex-employee joining a company network even though his company email address no longer exists.

Any thoughts on how this should be handled and also if it's a good idea to give users who have signed up using LinkedIn or Google Apps the option to edit their profile information (Name, Password, Profile image) during sign up?

Answer 1

The most user friendly and secure option is this: Whenever someone logs in or signs up to the company network their email is cross-checked against a whitelist of actual employees with legitimate access to the network.

If you allow sign up via email, there needs to be such a list already against which to cross-check. The same needs to happen on login, not just sign up. This, in fact, has nothing to do with the LinkedIn authentication whatsoever, but is equally true for anybody logging in or signing up with an email address.

In case the company network sign up process is manual, i.e. on sign up of a new user someone manually okays the user, then this information should be entered into a whitelist database. Consequently, when an employee leaves the company, they need to be deducted from that database.

Answer 2

In general, always confirm email address you receive unless the sign-in is done via the email provider (OpenID/OAuth). This prevents sign up with the wrong email address both intentionally and by mistake.

Specifically regarding this question:

If the account is a cooperate account (an account officially affiliated with the company with privileges to act on behalf of the company), then there should be company administrator accounts with the ability to cancel other cooperate accounts belonging to the company.

Answer 3

I'm not sure what you mean by 'company network' but I hope my thoughts may help you clear your question anyways: If you offer two ways to sign up with your service thats fine. But don't try to over-think it.

1. Sign-Up through linkedin: You know that the person has a valid linkedin account – but a.f.a.I.k. there's no way you can find out if the email address associated with that account is valid or not. From time to time there is actually people in the linkedin forums (like here) having exactly the problem you're describing: they're stuck with an invalid emil address. But that should not be your concern – or at least it's a problem you can't solve. The only thing you can know (and have to know) is that the linkedin profile is valid.

2. Sign-Up through email: The email address is valid – and that's that.

As the length of the previous paragraphs may suggest I would recommend focussing on 2) but of course that's your decision to make. Hope this helps somehow.