Account linking issues when there is more than one existing account linked

[philipmountifield]

Just been experimenting with account linking in multiple scenarios and hit some bugs.

Steps to reproduce:

1. Sign up with Facebook
2. Sign up with Google and account link when prompted
3. Sign up with another (e.g. DB with same email)

First thing I notice: the message for account linking on the 3rd account sign up (2nd account link) says "You main sign in with Google or Facebook to link accounts" but the continue button will always take you to the first of these options. not sure if it should give a choice, or just show the first matching identity to be consistent. Don't think the behaviour should should change in another situation to keep things simple.

Second more major thing: when I click continue the account linking takes place successfully as confirmed in the dashboard however, in the application it always hits a "Wrong state parameter given." error when the callback is executed. I've been testing this with Django using python-social-auth.

Thanks Philip

@fyockm Thanks for looking at that other bug for me, do you also work on this extension?

[stale[bot]]

Is this still relevant? If so, what is blocking it? Is there anything you can do to help move it forward?

[philipmountifield]

Lack of response from Auth0.

[stale[bot]]

Is this still relevant? If so, what is blocking it? Is there anything you can do to help move it forward?

[philipmountifield]

Still awaiting response

[stale[bot]]

Is this still relevant? If so, what is blocking it? Is there anything you can do to help move it forward?

[philipmountifield]

I give up, no-one from Auth0 seems to be monitoring their repo. Not very professional.

[stale[bot]]

Is this still relevant? If so, what is blocking it? Is there anything you can do to help move it forward?

[philipmountifield]

We hit this bug with a live user again recently. Very disappointing there has been no response.

[petrogad]

haha wow; can we fork this extension and just fix this?

[philipmountifield]

You'll probably have to if you want it fixed!

[picosam]

Wow, I'm really baffled at the inactivity on this repo... why not just archive it Auth0?!

[fernandobd42]

Same problem:

When trying to link the 2nd or the 3rd account, it doesn't link to the 1st account. Example:

• When tries to linking the 2nd account, it linking the 3rd account.
• When tries to linking the 3rd account, it linking the 2nd account.

It makes much more sense to always linking to the 1st account.

Looking into the code at api/get_index.js at line 25 I saw this code:

matchingUsers: users.filter(u => u.user_id !== sub)

One way to handle that is just sorting the result based on created_at to have the 1st account in position 0. To do that, just need to replace the current line to the next one:

matchingUsers: users
  .filter(u => u.user_id !== sub)
  .sort((prev, next) => new Date(prev.created_at) - new Date(next.created_at));

Or if anyone has a better way to do that. I think the current way to handle the linking is not the better one.

If you agree with me, I opened the PR doing that, do you are able to merge it then?! #81

@francocorreasosa @machuga @kusold

[machuga]

Forwarding this to the appropriate team. @ian-speers / @siacomuzzi

[fernandobd42]

Who can update the lib version to be able to install and use the extension at the auth0 with this fix @ian-speers / @siacomuzzi?

[siacomuzzi]

First of all, sorry for the delay in getting back to you.

A new version was published (v2.6.0) and contains the following fixes:

1. When there are multiple users with the same email, use the oldest one. Thanks @fernandobd42 !
2. When user has multiple identities, show only the first one in the introduction message (which is the same used by the "Continue" link).

when I click continue the account linking takes place successfully as confirmed in the dashboard however, in the application it always hits a "Wrong state parameter given." error when the callback is executed. I've been testing this with Django using python-social-auth.

Regarding this... is it happening in all cases (step 1, 2 & 3) or just when user has three identities (step 3)? A HAR file could be useful here to identify why python-social-auth isn't receiving the original state.

[jasailica]

I'm not working with this particualr client at the moment, so can't gather further debug, but the error was occuring at the point you try to link a 3rd account.

[siacomuzzi]

Unfortunately we wasn't able to reproduce the issue, so if you have the chance to get the HAR file, please let us know, thanks!

And apologies again for the delay.

[fernandobd42]

Yes, @jasailica, I updated the version of extension in one of our staging auth0 account and the problem only occurs when trying to link the 3rd account.

@siacomuzzi I will have a look into that and try to figure out what has been causing the problem.

FYI: in our production auth0 account, the workaround for the problem of linking with the wrong account is: Always when the user creates the 3rd account before redirecting them to the Account Linking page, we delete their 2nd account using a machine to machine auth0 APP API with (delete permission), it will force auth0 to always link with the 1st account, once they will have just the 1st account to link.

Is good to know that we've done that because we only allow them to access our platform using the 1st account, so before they link the accounts, always when they try to login using the 2nd account, they will be redirected to the Account Linking page.

Sorry for the delay.

[siacomuzzi]

Just FYI - In case you don't know, you can always introduce your own changes to the extension and deploy it as a custom one:

1. Go to <extension_folder>/webtask.json and update title, name, version, preVersion and author attributes (feel free to update any other attributes).
2. Push your changes to your custom extension repository (make sure to push them to master branch).
3. Go to Auth0 Extensions portal (https://manage.auth0.com/ => Extensions)
4. Click on + Create Extension
5. Fill in the textbox with your GitHub public URL (ie https://github.com/<YOU>/<YOUR_CUSTOM_EXTENSION>/)
6. Click on continue and finally, click on install

[fernandobd42]

@siacomuzzi Thank you very much for the information, I didn't know that.

While I try to figure out how to always merge with the 1st account without breaking the login/register flow we can roll back the changes to keep the extension working as before, and then as I found a way to do that I will publish as a custom extension.

[stale[bot]]

Is this still relevant? If so, what is blocking it? Is there anything you can do to help move it forward?

[richardscarrott]

Hi @siacomuzzi is there any further documentation on how to fork and deploy this extension; I've forked here https://github.com/richardscarrott/auth0-account-link-extension and updated the package.json + webtask.json but upon installing it, it creates an application correctly but the rule isn't created and the app isn't listed under the installed extensions tab?

[siacomuzzi]

Hi @richardscarrott,

Please check my last 2 commits @ https://github.com/siacomuzzi/auth0-account-link-extension/commits/master (there is no need to update package.json).

I just installed it and everything was configured as expected:

[richardscarrott]

@siacomuzzi I just started from scratch again and mimicked your last two commits -- but I'm still only getting the app installed, not the rule 🤔

Do you think it matters that I had previously installed the original extension?

EDIT: I just tried installing yours and it worked fine; I wonder if something changed in current master as your fork is older?

[siacomuzzi]

@siacomuzzi I just started from scratch again and mimicked your last two commits -- but I'm still only getting the app installed, not the rule 🤔

Do you think it matters that I had previously installed the original extension?

EDIT: I just tried installing yours and it worked fine; I wonder if something changed in current master as your fork is older?

• I had installed the original extension before install the custom one, so that shouldn't be a problem
• Make sure that you don't have an existing rule with the same name
• Please install and open the Real-time Webtask Logs extension before install your custom extension, you will get more details there.