Open emgollie opened 11 years ago
It occurs to me that even without the /api/identity endpoint, when we detect a badge email/logged in email mismatch we could give the user a chance to change logins, rather than reporting an error and exiting the acceptance flow.
Can we do that? For full context, this was in response to this google group conversation: https://groups.google.com/forum/#!searchin/openbadges/douglas$20phung/openbadges/yy_jh8gzcjc/CBcdDFVpXEAJ
this issue feels somewhat related to issue https://github.com/mozilla/openbadges/issues/42
Creating an issue from this email conversation (via @toolness):
Should we start displaying the email address the badge is going to or something? Is there a way to pre-populate the Persona window with the email address we're expecting them to authenticate against? I've always wished Persona had a feature like this, but afraid it doesn't.
One current thing that may help is to use the /api/identity Backpack Connect endpoint to get the user's hashed email address. This can be used to either issue badges to whatever email address the user has logged into Persona with, even if it's different from the one they use on the issuer's site. Alternatively, it can be used to compare the user's email address on the issuer's site with the email address they used to login to their backpack--at the very least, this would allow the issuer to say "yo, you're not logged into your backpack with the same email address that we have on file for you, so get your act together. Sorry for the inconvenience."
// cc @threeqube @toolness