Account-linking allows unlinking facebook which causes account-lockout.

Azure-Samples / active-directory-b2c-advanced-policies

Sample for use with Azure AD B2C with Custom Policies.

http://aka.ms/aadb2ccustom

MIT License

217 stars 143 forks source link

Account-linking allows unlinking facebook which causes account-lockout. #67

Open MichielCornilleESC opened 4 years ago

MichielCornilleESC commented 4 years ago

    </OrchestrationStep>`

Scenario:

sign up using facebook
user navigates to account-linking flow
selects UnlinkFacebookExchange

User is now locked out of account with no easy way for an admin to fix this. (password reset wouldn't work, sign up with facebook again creates a second account)

How can we avoid users from unlinking the only identity remaining? Thanks so much in advance for your time & help!