Automatic Account Linking with MultiTenancy

[oshalygin]

I've tested this one a few times and it seems that it works fine without multi tenancy but with multi tenancy the link based on MATCHING PROPERTY does not work. I'm not sure where this is on the road map but if I'm doing something wrong please let me know, I'd love to update the config on my end :)

Replicating:

1. Using the following settings on the organization:

2. These are the account stores in this organization

3. Creating an account in the SPCloud directory results in the following:

4. Later I come along in the application and create an account via social login. I get the following results in the Google directory:

5. Coming back to the SPCloud directory to see if the link persisted:

There is likely a disconnect somewhere and I realize MT on subdomain is still fairly new. I looked through the codebase of express-stormpath and I don't see any reference to account linking. If it's there, I'm open to diving in further.

Thanks gents.

[edjiang]

Are you able to do this on an app w/o multi-tenancy? It was my impression that accounts wouldn't automatically link if you did it in this order, unless the email was verified.

The risk here is that an attacker could register for an email based account w/o verifing the email. The real user then signs in with social login, and goes into the attacker's account. Since the attacker knows the password from the sign up process, the attacker now has access to all of the user's data.

[oshalygin]

The other path doesn't seem to jive w/ MT either:

• log in with social
  • it creates a social login account(I disabled automatic provisioning, so no SP Cloud account is provisioned)
  • log out
  • create an individual account(with email verification turned on)
  • go to my email and click the verification link
  • I am logged in, but looking at the portal the accounts arent linked.

These are the options I used with the above scenario:

[edjiang]

With the other path, it would probably only link when you log in with the social account a second time. The reason is that the cloud directory is always the 'master' directory in this scenario, so there's no account to link it to.

[oshalygin]

@edjiang you're right, after a bit of testing, the link is persisted after I log in again with the social account.

[edjiang]

Awesome! Glad you got it figured out =]