My registration system normally asks for 4 things: The user's full name, their email, their preferred username, and a password.
I want to add four oauth2 registration services to make it easier and faster for users to create an account.
I can see three methods for doing this, or maybe there is something more elegant I haven't figured out. Wondering what to pick. I am concerned about username collisions and ease-of-use:
Method 1
User clicks a button representing one of the four services. They confirm to allow authorization, and they are logged in. They get an email with their server-selected username, and somewhere in the interface that username shows as well.
In this scheme, the server will pick the username of the service if there's no username collision with my database. If there is a username collision, the server will add e.g. "2" to the username.
Method 2
With this method, they click to authorize, and then are prompted for the username either in the callback URL or in the original page, pre-populated with what the server thinks it should be. A little kludgy, but now they know what username they get, even if the email goes to spam.
Method 3
Two-step registration. The user (1) selects a username, and then (2) on the next screen they select either a full name / email / password, or to link it to a service via oauth2. Then (3) they authorize the link.
Observations:
- Method 1 is simplest in general terms, but risks the user losing or never getting/seeing/confirming their username.
- Method 2 is a bit kludgy.
- I think Method 3 is pretty clean, but needs two steps to register. Regular registrations actually become longer now...
- Method 3 requires a lock on a chosen username in the interim steps: If someone else creates a user with our user's username picked in step #1, and our user is in step #3, then the server needs to revert to Method #2 or Method #1. Alternatively, the username gets locked for some amount of time, but the edge case still remains. In summary, Method #3 is clean, but takes a few more steps than the other methods and has minute edge cases.
Thoughts on which method I should pick, if any?