Login flow with openid / social signin

Question

Due to a technical limitation / privacy settings openid does not always return an email. This leads to the following convoluted signup process:

1. User clicks on login with facebook.
2. User enters email and password on facebook site.
3. User is redirected back to our site.
4. User is requested to fill in email (for our site).
5. User is sent an email.
6. User clicks email authentication link.
7. User is logged in and can continue.

An email is a requirement for our site but asking a user to fill it in twice is not a very good flow. Is this too convoluted / complicated?

Answer 1

Facebook requires you to confirm your email during the signing up process. Therefore, you can assume the email linked to the user's Facebook account is legit.

You state:

Due to a technical limitation / privacy settings openid does not always return an email.

But, with the Graph API/OpenGraph, you can ask for this permission. So in that case you could obtain the email and store it if wanted.

If this is not something you would want to ask your users permission for, then I think you have to resort to the flow you described.