I want to build an application that allow users to log in via the following:
- my own authentication/authorization solution
- 3rd party providers, such as "log in with your Gmail account" or "log in with your Facebook account"
My concern is that an individual could create an account using my application's solution AND have a Gmail accou开发者_C百科nt AND have a FB account, etc. Though there may be various ways for a person to log in, they still all refer to the same individual. Despite multiple ways to log in, I want to be able to figure out if they refer to the same individual.
Questions:
- Is what I am thinking even possible? (Meaning, is there some way I'll be able to figure out that a Gmail account is referring to the same person with a particular FB account?)
- Any suggestions on general strategies on how to implement this?
Get the user to identify their accounts explicitly. Only let them link two accounts once they authenticate against both of them. See how stackoverflow does it (click "my logins" on your profile page).
You might also want to consider the issue of merging accounts. A user might create two accounts and then realise they only meant to have one. The way you resolve this will be specific to your problem domain and schema.
精彩评论