The Azure B2C sample policies (e.g Azure AD B2C account linkage at signup) provide a number of ways to link accounts, but they all rely on user input with regard to linking and unlinking accounts, which can be confusing. I believe a common scenario is simply wanting the user to authenticate using whatever method they choose, and have a common experience. It should be as un-complex as feasible.
Any linking and unlinking of social accounts could be part of users' account management, but shouldn't be part of the login.
Expanding on Azure AD B2C Auto Account Link the scenario would be:
Scenario 1
- User has previously signed up with a Local Account (bob@contoso.com)
- User logs in with Facebook, and Facebook returns the email claim - bob@contoso.com
- Facebook identity is merged into Local Account
- User is signed in
- User is not invited to sign in with their Local Account
Scenario 2
- User has previously signed up with Google (bob@contoso.com)
- User logs in with Facebook, and Facebook returns the email claim - bob@contoso.com
- Facebook identity is merged into Google Account
- User is signed in
- User is not invited to sign in with their Google Account
Scenario 3
- User has previously signed up with Google (bob@contoso.com)
- User signs up for a Local Account with bob@contoso.com (with verified email)
- Local account with password is merged into original account
- User is signed in (User can, in future sign in with local account + password)
- User is not be presented with error, stating the account exists
- User should not have to perform forgot password flow
Note that the last scenario, it is suggested that the original social account could be set up with a local account at the same time (and random password); the user would then receive a "this account already exists" error if signing up, but could do a Reset Password. But Password Reset involves repeating exactly the same steps as sign-up (confirm your email, provide your password).
(A previous question asked How do i link a social account with any existing local account during first time sign in from social login? but did not cover local merging with social, and fails if no local account exists.)