3

My question concerns the sign-up flow for a user joining a company network. The case is as follows:

An ex-employee has a LinkedIn account with a company email address(xyz@company.com). He tries to signup for a company network via LinkedIn. Now in this case we can never be sure if a user signing up via LinkedIn has a functional company account or not and so we'll have to verify his email-id which kind of defeats the purpose of sign up with LinkedIn. If we don't verify his email-id, we risk an ex-employee joining a company network even though his company email address no longer exists.

Any thoughts on how this should be handled and also if it's a good idea to give users who have signed up using LinkedIn or Google Apps the option to edit their profile information (Name, Password, Profile image) during sign up?

  • What happens if I'm an employee but I don't use my work email address for LinkedIn? Would you prompt me to provide my work email address? – Matt Obee Sep 9 '14 at 13:50
  • Yes, there will be an option to sign up using email. – Komal Waseem Sep 9 '14 at 17:35
  • @KomalWaseem Am I correct in assuming assume this is for a company('s employee) account and not a private account in LinkedIn? – Danny Varod Sep 9 '14 at 18:40
  • @DannyVarod No entirely. It's the user's private linked-in account but instead of signing up with a public domain (e.g gmail) email account, he has signed up for Linked-in using xyz@company.com (or a private domain) email account. However, he's left the company and the email account no longer exists. So now what happens if he tries to sign up for a service that requires a valid email-id using this Linked-in account? – Komal Waseem Sep 10 '14 at 4:54
  • @KomalWaseem If you say, "the email account no longer exists", that clearly applies to the company email acoount. It does not apply to the private email account, I guess? – virtualnobi Jan 8 '15 at 9:48
1

The most user friendly and secure option is this: Whenever someone logs in or signs up to the company network their email is cross-checked against a whitelist of actual employees with legitimate access to the network.

If you allow sign up via email, there needs to be such a list already against which to cross-check. The same needs to happen on login, not just sign up. This, in fact, has nothing to do with the LinkedIn authentication whatsoever, but is equally true for anybody logging in or signing up with an email address.

In case the company network sign up process is manual, i.e. on sign up of a new user someone manually okays the user, then this information should be entered into a whitelist database. Consequently, when an employee leaves the company, they need to be deducted from that database.

0

In general, always confirm email address you receive unless the sign-in is done via the email provider (OpenID/OAuth). This prevents sign up with the wrong email address both intentionally and by mistake.


Specifically regarding this question:

If the account is a cooperate account (an account officially affiliated with the company with privileges to act on behalf of the company), then there should be company administrator accounts with the ability to cancel other cooperate accounts belonging to the company.

  • I'm not sure if that answers the question what would happen if the user has a Linked-in account using xyz@company.com email id. Later, the xyz@company.com email account was deleted when he left the company but his Linked-in account still exists. He can sign up for services using this Linked-in account but how would services that need users to have a valid email account make sure that a user signing up with Linked-in account has a functional/valid email account. – Komal Waseem Sep 10 '14 at 5:00
  • @KomalWaseem Until you answered my comment on the question this was not clear. You do know that users can add multiple logins to LinkedIn, right? – Danny Varod Sep 10 '14 at 10:24
0

I'm not sure what you mean by 'company network' but I hope my thoughts may help you clear your question anyways: If you offer two ways to sign up with your service thats fine. But don't try to over-think it.

  1. Sign-Up through linkedin: You know that the person has a valid linkedin account – but a.f.a.I.k. there's no way you can find out if the email address associated with that account is valid or not. From time to time there is actually people in the linkedin forums (like here) having exactly the problem you're describing: they're stuck with an invalid emil address. But that should not be your concern – or at least it's a problem you can't solve. The only thing you can know (and have to know) is that the linkedin profile is valid.

  2. Sign-Up through email: The email address is valid – and that's that.

As the length of the previous paragraphs may suggest I would recommend focussing on 2) but of course that's your decision to make. Hope this helps somehow.

  • So I believe it is necessary for services to send users verification email to make sure they've signed up using a valid email account even though they've signed up using Linked-in. – Komal Waseem Sep 10 '14 at 5:03
  • Ok – so if that is the scenario, why worry? In the linkedin sign-up process you just have to make clear, that also that email adress has to be valid because the system is going to send out a validation mail… If sombeode still sings up but never confirms – then that's an invalid account. Or am I missing something? – tillinberlin Sep 10 '14 at 6:50
  • @tillinberlin (nice nick!) I guess the problem is that once the user had the company email, verified the LinkedIn account using it, and the left the company and lost the company email. Now this event cannot be detected in LinkedIn. – virtualnobi Jan 8 '15 at 10:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.