bug: If a social login is missing the required email and that email is already registered, the accounts will not be linked.

[imJack6]

Describe the bug

In my self-hosted Logto, I used a username and email address as registration identifiers. Then, I used a social connector that couldn't provide these two identifiers and enabled the feature requiring users to provide a valid registration identifier, as well as automatically linking accounts with the same identifier. When a user uses this social connector, they are asked to provide a username and email address for registration. The user enters an existing email address, sends a verification code, and after verification, it prompts that the account xxx@xx.com already exists and prompts them to continue logging in. At this point, there are two buttons: Cancel and Log In. Clicking Cancel requires re-verifying a new email address, while clicking Log In directly logs into the account with the added email address, without linking the social connector to that account.

Expected behavior

It can link this social connector to an account without needing to use an API.

How to reproduce?

1. Configure a social connector that does not return an email.
2. Enable the "Require users to provide a missing sign-up identifier" and "Automatically link accounts with the same identifier" features.
3. Set both the username and email address as required unique registration identifiers.
4. Ensure that a user account with the email address test@example.com exists.
5. Try logging in using the newly added connector.
6. When prompted for a missing email address, enter test@example.com and complete the verification.
7. Observe the prompts and confirm that clicking the login button does not link the used social connector.

Environment

Self-hosted (Docker image)

Screenshots

[simeng-li]

Thanks for the report. Please check whether the link_social query parameter is present on the link email and the subsequent verification code page.

e.g. http://localhost:3001/continue/email?link_social=4gj9xib7t1xa3i0keocm2&app_id=demo-app and http://localhost:3001/continue/verification-code?link_social=4gj9xib7t1xa3i0keocm2&app_id=demo-app

The expected happy path for linking the current social identity to an existing email account should be as follows:

[imJack6]

Thanks for the report. Please check whether the link_social query parameter is present on the link email and the subsequent verification code page.

e.g. http://localhost:3001/continue/email?link_social=4gj9xib7t1xa3i0keocm2&app_id=demo-app and http://localhost:3001/continue/verification-code?link_social=4gj9xib7t1xa3i0keocm2&app_id=demo-app

The expected happy path for linking the current social identity to an existing email account should be as follows:

When I tried to link my email, Logto sent me a registration verification code.

[simeng-li]

I see, thanks for sharing. The additional username fulfillment form lost track of the link_social status. We’re working on a fix, and it will be addressed in the next release.