My website has 2 different types of sign up/ sign in for user accounts: Facebook and e-mail.

If an user has an e-mail account, he provides us with his e-mail and creates a password, while Facebook only authenticates the user and provides us with basic info (e-mail, name, photo), but no password is required.

Currently, we treat users who have e-mail accounts but later sign in with facebook by checking if those e-mails provided match. If so, we ID them as the same user.

But...what about the other way around? If an user has first signed up with facebook, we lock that e-mail provided with that user's ID. So if he later tries to sign in with that same e-mail used for facebook, he won't be able to, as he never created a password.

How can I handle that situation? Force a Facebook sign up? E-mail authentication for the password? I'm puzzled.

1 Answer 1


Treat a transition from federated login to mail and password the way you would treat a self-service password reset. Send a message to the address with a one-time link to create a password. Then when the user follows the link, invalidate it and open the change password form.

  • 1
    Very well. I'm testing that right now. The challenge now is communicating that so light users understand what's going on. Thank you. Commented Jan 27, 2016 at 11:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.