GitHub IDP linked to other account

[aslakknutsen]

Setup:

1 unapproved account only linked with GitHub IDP in KC
1 approved account linked with RHD and OSO

• User press login and comes to Getting Started page
• Getting Started page show GitHub not linked
• User press Connect accounts
• User wants to link to GitHub account that is in use by another unapproved account
• User is redirected to GitHub and back to KC and back to Core
• User is back at Getting Started page which shows GitHub is not linked.

The Flow/Page/Error from KC about there being another Account linked to same GitHub account seems lost.

[sunix]

https://youtu.be/NqI7pG5V4No

[dlabrecq]

It's not clear what is meant by "User wants to link to GitHub account that is in use by another unapproved account"? Should users be able to link to an unapproved account?

Note that the getting started page simply calls the /login/linksession API with a redirect URL. That API controls what accounts can be linked to. @aslakknutsen @alexeykazakov can comment on that?

That said, if we want to allow users to link any GitHub account, the API should be changed. If the user doesn't need to link GitHub, the UI design also needs to change.

[alexeykazakov]

Unapproved account should not be linked to GitHub at all. It's impossible to link unapproved account using openshift.io UI. Hover users can link accounts using Keycloak UI/REST API or core API. But in this case I guess @sunix has a leftover from our workaround when we switched to GitHub auth during RH outage. Such outdated GitHub accounts should be deleted from our KC.

But anyway. This is a known upstream issue in Keyclaok. We we try to link a KC account to some Federated Identity (github in this case) already linked to another user then KC just silently ignores it instead of returning an error. This is something we should re-test carefully and file as an issue to KC.
That could cause problems for user with multiple openshift.io accounts.

[alexeykazakov]

Moved to fabric8-services/fabric8-auth#36
Closing.