omab/django-social-auth — Issue #217: Integrity errors can be generated if 'id' is returned by get_user_details()
Author: calebbrown
Created: 2012-01-09 04:32:42+00:00
State: open

If you have a response like the following:

```python
reponse = {
'id': 2,
'email': 'user@example.com',
'username': 'testuser',
'first_name': 'test',
'last_name': 'user',
}
```
And a custom OAuthBackend like below:

```python
class MyAuthBackend(OAuthBackend):

def get_user_details(self, response):
return response
...
```

An IntegrityError can be thrown if the Django user created has an id different to the id in the response or existing data could be overridden.

This is because `social_auth.backends.pipeline.user.update_user_details()` blindly writes all the fields returned by `get_user_details()` (except username) to the User object. In this case the `id` will overwrite the existing `id` causing the User object to insert a new record (causing the IntegrityError) or overwrite another record.

I think that `update_user_details()` should filter for `id` and `pk` along with `username` to avoid this from happening.

I think this is better than just telling developers to not return `id` or `pk` from `get_user_details` because it is hard to debug and because a method called `update_user_details()` really shouldn't be touching these fields - even if they are set.