I'm using Facebook to authenticate users. We also have conventional username/ password login and registration form too. Anyway, when a user chooses to login with Facebook, we use the following procedure:
- Redirect to Facebook, user is authenticated, returneded from Facebook to the app - email, name, facebook ID etc is provided from FB .. but ofcourse, no password
- We look in our system for any existing user by the email address. If a user is found, then that is the currently logged in user; otherwise, create a new user with the user info returned from FB.
Email kinda makes sense as we don't want duplicate email addresses (also the database currently won't allow it due to unique index) so if a user has signed up already with that email address, it won't attempt to create a new user for them. Instead it will pull the previously registered user.
Is this the sound approach though? Exploring all possibilities, I was wondering what happens in the event that the user tries to register by our conventional registration form, but as they have already created an account with that email from their initial Facebook login, we wouldn't allow the duplicate email. So having made the decision to use their Facebook to login, they are stuck with that method. Is this a common/ok approach?
Also without intention, if they use the conventional registration form first, and setup their account that way, we have their password, so they could login using our form or login with FB and the user account will just be pulled by email. However, if they choose to login with FB first time, and their account is created that way (we won't obtain the pw), they must always use FB only. I've absolutely no idea whether this could be problematic or not, I kinda want to go with the option of - whatever means you chose to login/register first time round - then that's what you stick with :)
I'm a little new to having users sign up with multiple logins so heads a bit full of "what ifs" etc. Would appreciate any advise on this, and common approaches. Thanks
Alternatively, we loose the index on the email field, add a field somewhere to store the facebook ID, and at the application level decide whether to permit duplicate email address and more distinction between users of different login methods (therefor allowing a user to have a conventionally registered user account, and/or a seperate facebook login auth/created user account, both with the same email address - but different methods of login - least if the user deletes their Facebook account, they can create an account with their email through our register form)