In Azure AD B2C, how can we account link automatically at sign up and sign in? User should only ever have one account

Viewed 445

The Azure B2C sample policies (e.g Azure AD B2C account linkage at signup) provide a number of ways to link accounts, but they all rely on user input with regard to linking and unlinking accounts, which can be confusing. I believe a common scenario is simply wanting the user to authenticate using whatever method they choose, and have a common experience. It should be as un-complex as feasible.

Any linking and unlinking of social accounts could be part of users' account management, but shouldn't be part of the login.

Expanding on Azure AD B2C Auto Account Link the scenario would be:

Scenario 1

  • User has previously signed up with a Local Account (bob@contoso.com)
  • User logs in with Facebook, and Facebook returns the email claim - bob@contoso.com
  • Facebook identity is merged into Local Account
  • User is signed in
  • User is not invited to sign in with their Local Account

Scenario 2

  • User has previously signed up with Google (bob@contoso.com)
  • User logs in with Facebook, and Facebook returns the email claim - bob@contoso.com
  • Facebook identity is merged into Google Account
  • User is signed in
  • User is not invited to sign in with their Google Account

Scenario 3

  • User has previously signed up with Google (bob@contoso.com)
  • User signs up for a Local Account with bob@contoso.com (with verified email)
  • Local account with password is merged into original account
  • User is signed in (User can, in future sign in with local account + password)
  • User is not be presented with error, stating the account exists
  • User should not have to perform forgot password flow

Note that the last scenario, it is suggested that the original social account could be set up with a local account at the same time (and random password); the user would then receive a "this account already exists" error if signing up, but could do a Reset Password. But Password Reset involves repeating exactly the same steps as sign-up (confirm your email, provide your password).


(A previous question asked How do i link a social account with any existing local account during first time sign in from social login? but did not cover local merging with social, and fails if no local account exists.)

1 Answers

To achieve your version of scenario 1/2, remove steps 1-7 in the HandleLinkLocalToSocial subjourney.

Scenario 3 needs a little more work. You need to detect if the account exists first, then write the account without throwing an error if it already exists.

The reason I made account linking as per the sample, is to prevent hijacking someone’s account, eg they have Google with MFA, but Facebook with weak password. User sign up with Google but attacker hijacks the account using login with their Facebook. User thought it was secure since they used 2FA for Google but forgot their FB login was weak.

Related