socialsignin/spring-social-security — Issue #8: Ensure that a connection cannot be associated with 2 different local user accounts
Author: michaellavelle
Created: 2011-12-27 22:36:38+00:00
State: open

A situation can arise in the current implementation where a single 3rd party provider connection can be associated with two different local user accounts. This causes a problem the next time a user logs in with one of these connections as spring social can't determine which of the local accounts to use to log in with, and returns a "multiple users" error.

This situation happens when a logged-in user "connects" their local account to a 3rd party provider which already is associated with a different account. To prevent this we should check if a connection already is associated with a different local account when a user uses the "connect" functionality.