Django-allauth: Linking multiple social accounts to primary site account

[gitdeepak]

I am wondering if allauth supports this scenarios:

• if a user logs in using a social account - does this app have the ability to ask the user if he already has a site specific account - if (yes) - link the social account to site specific account -- if (no) then create a brand new account using social account.

Thus the user can have multiple social account linked to a single primary site specific account and it eliminates the user having multiple accounts in the site. Thus multiple emails from the several social accounts will point to a single site specific account and the user has the ability to login from any of his accounts BUT logins into the primary account.

Thanks
Deepak

[karambir]

Are you saying that social account should be automatically linked to the existing account?
Because if so, it may open a huge security hole.

It should be implemented in a way that when a local(site specific) account exists, it should prompt the user to first login then complete the social account connection process.

[pennersr]

The app does allow for adding additional social accounts to your existing local account. However, the related flow does not match what you describe. Once signed in the user can manage (add/remove) social accounts to his existing account over at /accounts/social/connections/

While I have seen the flow you describe in the wild I am not convinced it gives a good user experience:

• Asking that "do you already have an existing account?" question introduces an unnecessary additional step for the most frequent use case (=normal social signup). Social signup could be completely non-interactive -- no questions asked.
• When you need to add a new e-mail address to your existing local account, your first instinct is not to signup using that e-mail address and hope that the system will ask a question whether you really meant to signup.
• Signup should be about signup -- that fits the mental picture of the user. All other actions relating to account management can be done once signed in to the account, including adding/removing additional social accounts.

As it stands now, when the user forgot all about his local account and does attempt to signup using a social account he will be made aware of this because the system will start complaining that e.g. his e-mail address is already in use. If he really forgot all about his local account the user can follow the password reset, login, and use the social connections management screen to hookup social accounts.

This "e-mail in use" error could be polished a bit, e.g. show additional help like "if you already have an account sign in first _here_(link)" -- but that is up to the designer.

Somewhat related to this discussion: http://stackoverflow.com/questions/13140021/django-allauth-linking-multiple-social-accounts-to-a-single-user