My website has 2 different types of sign up/ sign in for user accounts: Facebook and e-mail.
If an user has an e-mail account, he provides us with his e-mail and creates a password, while Facebook only authenticates the user and provides us with basic info (e-mail, name, photo), but no password is required.
Currently, we treat users who have e-mail accounts but later sign in with facebook by checking if those e-mails provided match. If so, we ID them as the same user.
But...what about the other way around? If an user has first signed up with facebook, we lock that e-mail provided with that user's ID. So if he later tries to sign in with that same e-mail used for facebook, he won't be able to, as he never created a password.
How can I handle that situation? Force a Facebook sign up? E-mail authentication for the password? I'm puzzled.