Import Users to MongoDB and then link it with OneLogin (when user logins) - NextAuth v4

[heylols]

Question 💬

I have OneLogin setup and working fine and uses MongoDB as database. But the problem is, I have some existing Users(from my previous PHP application) which I will add(import) to this database. But I want to automatically link when the actual User(that I imported) logins via OneLogin to my app for the first time.

Am I stuck with this linking part. Any thoughts? email would be the field that would act as the bridge. I mean for the imported Users with the actual User logging in.

How to reproduce ☕️

..

Contributing 🙌🏽

Yes, I am willing to help answer this question in a PR

[anguskeatinge]

I am facing something similar at the moment.

NextAuth doesn't support automatically linking, instead the user needs to be logged in before selecting the oauth signIn and then it links them for you.

I would probably do something like so:

1. importing those users into your database
2. allowing them to sign in with the EmailProvider (i.e. magic link)
3. once they are signed in, prompt them to click the OneLogin button to link that to the database user. signIn('onelogin') on the client.

After they click the button:

1. They will go through the onelogin flow
2. If the correct email is associated with that OneLogin account, nextauth will set the userId field on the account object in the database
3. Bob's your uncle

[balazsorban44]

Just to clarify, not supporting account linking when the user is not logged in is a deliberate choice to increase security, and is often overlooked by other solutions.

next-auth/src/server/lib/callback-handler.js

Lines 184 to 200 in 86baefd

	// If the user is not signed in and it looks like a new OAuth account then we
	// check there also isn't an user account already associated with the same
	// email address as the one in the OAuth profile.
	//
	// This step is often overlooked in OAuth implementations, but covers the following cases:
	//
	// 1. It makes it harder for someone to accidentally create two accounts.
	// e.g. by signin in with email, then again with an oauth account connected to the same email.
	// 2. It makes it harder to hijack a user account using a 3rd party OAuth account.
	// e.g. by creating an oauth account then changing the email address associated with it.
	//
	// It's quite common for services to automatically link accounts in this case, but it's
	// better practice to require the user to sign in *then* link accounts to be sure
	// someone is not exploiting a problem with a third party OAuth service.
	//
	// OAuth providers should require email address verification to prevent this, but in
	// practice that is not always the case; this helps protect against that.