Improved ways to link accounts #17

CoderSpinoza · 2018-04-09T07:56:28Z

#10 demonstrates developers' concerns with correctly linking custom oauth providers with users already signed in with privileged providers. @nicolasgarnier wrote a wonderful comment on how this can be achieved using Auth#setCustomUserClaims(uid, customClaims).

Although there is a limitation in this approach, compared to FirebaseUser#linkWithCredential() method, I assume this could be a fair guide to third-party developers for structuring complete auth system with multiple oauth providers including custom ones.

Could you review this pull request? @nicolasgarnier @samtstern

p.s. Token verification functionality was added to Kakao API so I also included it. :)

Updated versions to match the latest development environment. Signed-off-by: Hara Kang <[email protected]>

Since the first implementation, token verification functionality was added to Kakao API. This API prevents spoof attack by allowing apps to check if the token is indeed issued for themselves. Signed-off-by: Hara Kang <[email protected]>

Exhibit better ways to link custom oauth providers for users already signed with built-in providers. The current best way to do so is organized in the github issue FirebaseExtended#10 below: FirebaseExtended#10 Admin.auth.Auth.setCustomUserClaims(uid, customUserClaims) was added for setting custom data for control access. TODO: As mentioned in the above issue, clients should ensure that the same user is previously signed in with built-in providers (facebook or google), but this is omitted in the sample. It is each developer's responsibility to ensure this for security. Signed-off-by: Hara Kang <[email protected]>

nicolasgarnier

Thanks for starting this :) To the best-practice linking flow we'll need to do a few extra things (including some work on the Client).

nicolasgarnier · 2018-04-09T13:53:50Z

kakao/KakaoLoginServer/app.js

+          params['photoURL'] = photoURL;
+        }
+        console.log(`creating a firebase user with email ${email}`);
+        return firebaseAdmin.auth().createUser(params);


Since you are creating a user with Kakao you should mark it as being a Kakao user using setCustomUserClaim({lineUID: lineMid})

Yeah, you are right. :) Added the logic.

nicolasgarnier · 2018-04-09T13:55:22Z

kakao/KakaoLoginServer/app.js

-      if (email) {
-        updateParams['email'] = email;
+  console.log(`fetching a firebase user by email ${email}`);
+  return firebaseAdmin.auth().getUserByEmail(email)


Are there some cases where the email is empty? In this case I think we'd need to check that first. IF the email is empty you can look for the user using getUser('kakao:${userId}') he should already be a Kakao user for sure.

nicolasgarnier · 2018-04-09T14:08:18Z

kakao/KakaoLoginServer/app.js

+  console.log(`linking user with kakao provider with app user id ${userId}...`);
+  return firebaseAdmin.auth()
+    .setCustomUserClaims(userRecord.uid,
+      {kakaoUID: userId}).then((Void) => Promise.resolve(userRecord));


The last line, the same is:

{kakaoUID: userId}).then(() => userRecord);

Fixed it :)

nicolasgarnier · 2018-04-09T14:13:04Z

kakao/KakaoLoginServer/app.js

-        updateParams['email'] = email;
+  console.log(`fetching a firebase user by email ${email}`);
+  return firebaseAdmin.auth().getUserByEmail(email)
+    .then((userRecord) => linkUserWithKakao(userId, userRecord))


Here you should check that the user is a Kakao user by check ing that he has an attribute lineUID equals to the Kakao UID.

Then if the user is already a Kakao user, no need to link him again. Just return the user.

If the user is existing but he is NOT a Kakao user you need to "link" the user. Normally you should ask the user to sign-in using the other provider first (e.g. Google or Facebook) and only once he signed-in you can mark him as "linked".

@nicolasgarnier

How about utilizing email_verified field that most oauth providers provide? This can simplify login process since re-authenticating with facebook or google is not necessary.

Here is the modified logic.

First check with uid kakao:${userId}

This should be done first. Users signed up with kakao should be able to login again whether he or she has email field or not.

What if email is empty?

Email could be empty due to lack of user consent. There is no way to map this user with any existing user if email is not given. Custom provider UIDs cannot be queried from custom user claims. There are two choices.

Disallow creating a user

Users will have to re-authenticate with providers with valid email and link again by passing firebase ID token (which will be used to retrieve firebase uid on the server-side) and Kakao access token.

Just create a new user and deal with mapping later on user requests

In this sample, just go with the second choice, cuz it's just sample. :)

If email is present and there is a user with the email, give custom token to user if email is verified, make users re-authenticate with other providers if not verified.

If the email from Kakao provider is not verified yet, it is dangerous, in user security perspective, to give custom token since it might be different person with unverified email account. Therefore, only give custom token when email is verified. Throw an error otherwise, so that users can re-authenticate with other oauth providers first and link Kakao account later. This commit also contains other minor fixes mentioned in FirebaseExtended#17. Signed-off-by: Hara Kang <[email protected]>

CoderSpinoza · 2018-04-10T08:48:01Z

@nicolasgarnier

Always thanks for your prompt review :) I added a new commit that contains several fixes you mentioned.

CoderSpinoza · 2018-05-14T01:00:11Z

@nicolasgarnier

Any update on this PR? :)

nicolasgarnier · 2018-05-15T15:14:33Z

Hey @CoderSpinoza sorry about that :) I'll get to it soon, I'm just done with a quite busy bunch of weeks.

CoderSpinoza · 2018-06-25T01:59:15Z

@nicolasgarnier Haha, guess you are busy these days! Just get to it whenever you are free :)

nicolasgarnier · 2018-06-25T10:26:32Z

kakao/KakaoLoginServer/config.json

+  "kakao": {
+    "appId": -1
+  }
+}


Missing line break at end of file :)

nicolasgarnier · 2018-06-25T15:20:40Z

kakao/KakaoLoginServer/app.js

+      return firebaseAdmin.auth().getUserByEmail(email)
+        .then((userRecord) => {
+          if (!emailVerified) {
+            throw new Error('This user should authenticate first ' +


Here I would return a special error with a specific code so that we can act a special way when this happens.
Currently a new User gets created. Maybe do:

const error = new Error('This user should authenticate first ' + 'with other providers'); error.code = 'auth/existing-account-need-auth'; error.lineAccessToken = kakaoAccessToken; // Pass the access Token up to here, we'll need it for later. throw error;

nicolasgarnier · 2018-06-25T15:31:05Z

kakao/KakaoLoginServer/app.js

@@ -126,7 +200,7 @@ app.post('/verifyToken', (req, res) => {
  createFirebaseToken(token).then((firebaseToken) => {
    console.log(`Returning firebase token to user: ${firebaseToken}`);
    res.send({firebase_token: firebaseToken});
-  });
+  }).catch((error) => res.status(401).send({message: error}));


maybe I would change message to error since it's really an error more than a message :)

Important point: in the Android Client application we need to display a special message when error.code === 'auth/existing-account-need-auth'; and in that case we need to link the account if the user signs-in with the existing account. To do that we need to add a new endpoints to just "link accounts" where you would pass the kakaoAccessToken and the existing firebase user's ID Token.

nicolasgarnier · 2018-06-25T15:37:19Z

Sorry for the delay ^^ I'll try to be faster next time :P

phs1919 · 2019-06-10T07:22:47Z

Any updates? :)

luizjunior05 · 2020-01-08T22:34:25Z

Any updates? This is very important.

fysoul17 · 2020-01-27T12:38:05Z

Waiting for updates too.

forresthopkinsa · 2021-08-09T21:05:20Z

Custom auth is not practical without the ability to merge accounts. +1

CoderSpinoza added 3 commits April 9, 2018 14:38

[kakao] update library versions

fabb737

Updated versions to match the latest development environment. Signed-off-by: Hara Kang <[email protected]>

[kakao] add token verification logic

46470c1

Since the first implementation, token verification functionality was added to Kakao API. This API prevents spoof attack by allowing apps to check if the token is indeed issued for themselves. Signed-off-by: Hara Kang <[email protected]>

nicolasgarnier suggested changes Apr 9, 2018

View reviewed changes

nicolasgarnier suggested changes Jun 25, 2018

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Improved ways to link accounts #17

Improved ways to link accounts #17

CoderSpinoza commented Apr 9, 2018 •

edited

Loading

nicolasgarnier left a comment

nicolasgarnier Apr 9, 2018

CoderSpinoza Apr 10, 2018

nicolasgarnier Apr 9, 2018

nicolasgarnier Apr 9, 2018

CoderSpinoza Apr 10, 2018

nicolasgarnier Apr 9, 2018

CoderSpinoza Apr 10, 2018 •

edited

Loading

CoderSpinoza commented Apr 10, 2018

CoderSpinoza commented May 14, 2018

nicolasgarnier commented May 15, 2018

CoderSpinoza commented Jun 25, 2018

nicolasgarnier Jun 25, 2018

nicolasgarnier Jun 25, 2018

nicolasgarnier Jun 25, 2018

nicolasgarnier commented Jun 25, 2018

phs1919 commented Jun 10, 2019

luizjunior05 commented Jan 8, 2020

fysoul17 commented Jan 27, 2020

forresthopkinsa commented Aug 9, 2021

Improved ways to link accounts #17

Are you sure you want to change the base?

Improved ways to link accounts #17

Conversation

CoderSpinoza commented Apr 9, 2018 • edited Loading

nicolasgarnier left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

CoderSpinoza Apr 10, 2018 • edited Loading

Choose a reason for hiding this comment

CoderSpinoza commented Apr 10, 2018

CoderSpinoza commented May 14, 2018

nicolasgarnier commented May 15, 2018

CoderSpinoza commented Jun 25, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

nicolasgarnier commented Jun 25, 2018

phs1919 commented Jun 10, 2019

luizjunior05 commented Jan 8, 2020

fysoul17 commented Jan 27, 2020

forresthopkinsa commented Aug 9, 2021

CoderSpinoza commented Apr 9, 2018 •

edited

Loading

CoderSpinoza Apr 10, 2018 •

edited

Loading