Logging in using GitHub with different primary e-mail address offers to create new account

[MikkCZ]

I have different primary e-mail address for GitHub than for my LDAP and Mozillians account. However I have the GitHub account connected to my Mozillians profile. When I click "Log In" in Discourse and use GitHub login, I am offerred to create a new account. sso.mozilla.com recognizes my identity correctly.

STR:
0. Have differrent primary e-mail address for GitHub than for Mozillians.

1. Go to sso.mozilla.com and sign out.
2. Go to discourse.mozilla.org and click Log In.
3. Choose GitHub log in.

After you log in with GitHub, you see a modal JavaScript window offering to create new account in Discourse. Instead Discourse should correctly recognize me based on the Mozillians account associated with the GitHub account.

┆Issue is synchronized with this Jira Task

[LeoMcA]

sso.mozilla.com recognizes my identity correctly.

What do you mean by this? I'm in the same position as you (different emails for LDAP/Mozillians and GitHub), but if I log into sso.mo.co with each I log into different accounts.

Can you compare https://sso.mozilla.com/info when logged in with LDAP to https://sso.mozilla.com/info when logged in with GitHub to see if the accounts really are the same?

[MikkCZ]

You are right, those identities are different, which is weird, because I remember linking GitHub to my Mozillians account and I see it listed in my profile settings. How can I proceed to merge those identities respectively being able to login to my account using GitHub?

[LeoMcA]

With the way that IAM is currently designed, you can't - you can only use your LDAP account to log in. If you update your GitHub email address to match your LDAP address you won't be allowed to log in with GitHub.

[MikkCZ]

Should I file a report in https://github.com/mozilla-iam/mozilla-iam/issues, or is the use case already covered in an existing ticket?

[LeoMcA]

There's no ticket I know of which covers allowing users to log in with two different providers (e.g. LDAP and GitHub) with different email addresses, but resulting in the same account.

If you update your GitHub email address to match your LDAP address you won't be allowed to log in with GitHub.

Roughly this is covered in mozilla-iam/auth0-deploy#195

[MikkCZ]

I have created a ticket (wow, with a number 2 times 💯 ) to allow linking provider logins with different email addresses. Feel free to reword it if my explanation there is not clear.