Authentication flow #133

New issue

Closed

opened 2025-08-04 15:13:22 +02:00 by moritz · 2 comments

moritz commented

2025-08-04 15:13:22 +02:00

Owner

email field is only part of member, remove the user email field
user authentication with password is identified by member mail
user authentication with oidc is identified by oidc_id
- On OIDC login, when there is no user with oidc_id:
  - if there is a member with the same email associated with a password authenticated user:
    - ask for password and associate the user with the oidc_id
  - if there is a member with the same email but without user
    - create a new user and associate it with the member
  - else:
    - create a new member with a new user
- On OIDC login, if a member and user already exist, update the member email to the one passed from the OIDC provider

- email field is only part of member, remove the user email field - user authentication with password is identified by member mail - user authentication with oidc is identified by oidc_id - On OIDC login, when there is no user with oidc_id: - if there is a member with the same email associated with a password authenticated user: - ask for password and associate the user with the oidc_id - if there is a member with the same email but without user - create a new user and associate it with the member - else: - create a new member with a new user - On OIDC login, if a member and user already exist, update the member email to the one passed from the OIDC provider

moritz added this to the Accounts & Logins milestone 2025-08-04 15:13:22 +02:00

moritz added this to the Sprint 5 - 31.07. - 11.09. project 2025-08-04 15:13:23 +02:00

moritz commented

2025-08-05 13:08:03 +02:00

Author

Owner

email field with AshAuthentication:

password strategy requires a real identity_field
computed/virtual Fields don't work as identity_field
a custom password strategy is complex and not good documented

solution 1:

keep the email field in user
read-only access
sync with member email field
ensure it with a validation function
avoiding inconsistency could be complex

solution 2:

user.email is the single source of truth Member email is automatically set from user email
Members without a user have their own email field
OIDC sets the user email; member email follows automatically
Easier to understand - User.Email is the source
OIDC works naturally - sets User.Email directly
No inconsistency - Member email follows automatically
Members without a user remain unaffected
AshAuthentication works - has a real email field

email field with AshAuthentication: - password strategy requires a real identity_field - computed/virtual Fields don't work as identity_field - a custom password strategy is complex and not good documented solution 1: - keep the email field in user - read-only access - sync with member email field - ensure it with a validation function - avoiding inconsistency could be complex solution 2: - user.email is the single source of truth Member email is automatically set from user email - Members without a user have their own email field - OIDC sets the user email; member email follows automatically - Easier to understand - User.Email is the source - OIDC works naturally - sets User.Email directly - No inconsistency - Member email follows automatically - Members without a user remain unaffected - AshAuthentication works - has a real email field