Multiple accounts with same email not combining (Google & Facebook)

[ahaverty]

Environment:

• Android device: Nexus 6P
• Android OS version: Android N
• Google Play Services version: 9.4.0
• Firebase/Play Services SDK version: 9.4.0
• FirebaseUI version: 0.5.3

The problem:
Signing up with the same email address via two different providers (Facebook and google), is resulting in two different users, but only one having the email address.

Steps to reproduce:
With 'Multiple accounts per email address' enabled, and Facebook and Google signup providers working (and capturing emails) for fresh users.

1. Signup as a new user with either provider, (firstly removing any previous firebase accounts with the same email).
2. Notice the users email was captured in the firebase console.
3. Logout and signup via the alternative provider, using an account that has the same email as step one.
4. Notice firebaseUi proceeds, but creates a new firebase user without an email address
5. What is strange is that alternating between the provider I try from fresh, both Google and Facebook can capture the email, but not after an account with the email has been made.

Expected Results:
I'm expecting the accounts to be joined together.
Am I wrong in assuming FirebaseUI should do this?
Disabling 'Multiple accounts per email address' is a great workaround considering that FirebaseUi notifies a user about an existing account, but it would be nice to get past this small issue if this repo is already capable.

I'm not seeing any logs for firebaseui, presumably because I'm not hitting any errors. Let me know if I should be or if I can provide any more detail.
Thanks for the help!

[ahaverty]

I've perhaps misunderstood firebase's 'multiple accounts per email address' feature. (I assumed it allowed me to join a facebook and google provided user under the same firebase UID, but it looks like it allows multiple different firebase users/UIDs with duplicate emails?)
However I still believe I've found a defect with FirebaseUi not capturing emails after the first user account.

[samtstern]

@ahaverty I understand your confusion, but this is working as intended. Multiple accounts per email address means exactly what it says: there may be multiple Firebase Auth accounts with the same user email address. These accounts are distinct.

In order to get the accounts to merge you need to disable that setting in your console. Then FirebaseUI will attempt the link account flow.

[samtstern]

@ahaverty could you explain your second issue a little more? "not capturing emails after the first user account".

I don't quite understand the issue.

[ahaverty]

Sure,

1. Say I have a google account (alan@test.com) and a Facebook account (alan@test.com)
2. I remove all firebase users from Firebase.
3. I register a new user using FirebaseUi with my google account first via the google provider, all goes well and firebase console creates a new user with my alan@test.com email attached to that user
4. I then logout, and try to register using my Facebook account this time.
5. FirebaseUi seems to go okay, a new user is created in firebase console, but this time the email is blank (I'm seeing "-")
6. Going back to step 2, clearing all users, but this time trying Facebook registration first, all works okay, including the email address being attached this time
7. Trying google registration second, a new user is created okay, but like Facebook in step 5, there's no email attached to the new user

Does that make sense?

Thanks for clarifying the merge for me, thats exactly what I need

[samtstern]

@ahaverty this does sound like a bug (I didn't implement that behavior but it's not what I would expect either).

I will look into it, thanks for the report!

[ahaverty]

Just to add a very minor finding. It looks like firebase's console was updated in the last day. Anonymous user's email field is now clearly denoted by '(anonymous)' whereas the issue I was having, still shows the email field as a '-'

[ahaverty]

Just on the off-chance this is related, I'm now getting duplicated provider icons on users with merged providers. I'm only using this repo to register users.
I'll send in a bug ticket to firebase also.

[amandle]

@ahaverty I just spoke with the Firebase team, and they confirmed that this is a known issue with Firebase iteself.

[jashick]

Any update on when this will be resolve?

[maksimluzik]

Is this still valid, it was closed as wontfix, but the bug still exists? I am confused...

This looks like kinda major issue

[jashick]

When you check the box in Firebase to not allow duplicate accounts with the same email, I (and most people I imagine) would expect the following functionality:

Scenario 1
-User creates an account using email and password... account created. User then tries to create an account via Facebook tied to the same email "Gets an error that an account already exists with that email" (This does not happen, instead, a new account is created in firebase with a "-" for the email)

Scenario 2
-User creates an account using email and password... account created. User then tries to create an account via Gmail tied to the same email "Gets an error that an account already exists with that email" (This does not happen, instead, the accounts are merged because, hey, gmail is superior above all ?!... ugh)

Scenario 3
-User creates an account using Facebook.... account is created. User then tries to create an account via email and password using the same email. Gets an error that an account already exists with that email. (This Does happen which is the expected behavior).

From what I gather, Firebase seems to not give the email/password account much credit. I would expect that the accounts be merged or denied when another account is created associated with the same email. It doesn't except for Gmail. It seems to think Gmail is superior to all other account types and allows it to take precedence.

Firebase: Either merge all accounts when logging in with a new provider, or throw an error that an account already exists with that email. The mixed results are annoying and prevent consistent rules.

[samtstern]

@jashick I am surprised at scenario #1, can you file a new issue about that?

For #2, it's not that "gmail is superior" but that since this is a Google API talking about Gmail accounts on an Android device in a signed APK we can safely verify gmail ownership. So we know that the user is the same person.

[erikswed]

Maybe I missed something but why is this issue still closed?

[tuongaz]

This is the reason why we have moved away from Firebase

[samtstern]

This issue is closed because it's not a problem within FirebaseUI-Android but rather something that exists in the Firebase Android SDK so this is not the right place to track it.

[ghost]

For me right now, the issue that I am having is if I create an account with Facebook then create one with Gmail using the same email, Gmail overrides the Facebook account, but if I do it vice versa Facebook won't create an account since I look for the error indicating 'auth/account-exists-with-different-credential' in both cases, but only one seems to work.

[marcosluizfp]

I am facing the same problem as you macsinte. It seems Firebase (aka Google) doesn't trust so much in Facebook email registration process or in the Facebook login process... For sure, if someone can fake an email he/she could get access to an unauthorized place - may be this is the line Firebase is going on for now.

[samtstern]

@marcosluizfp you've got the basic idea correct. To add a Facebook credential with an email that matches and existing account you need to use the "link credential" flow to verify the original credential.

With Google accounts we can securely verify the email (because Firebase can talk directly to Google's identity systems) so this is not the case.

[onurtekin]

@samtstern in this case "link credential" does not work, don't even give any error. You end up with no "currentUser".

[SUPERCILEX]

@onurtekin If you're looking for automatic account merging, take a look at #123 (comment) and #123 (comment).

[onurtekin]

@SUPERCILEX Actually i don't use Firebase-UI. I have encountered this issue on my IOS app. This is a fresh topic and i couldn't find any IOS topic related to this issue.

In my case i try to handle returning users.

1. User registers with a provider other than Facebook.
2. User signs out, uninstalls/updates the app or credentials times out.
3. User comes back, could not remember the provider and this time decides to use Facebook.
4. I get the 17012 error.
   5.Then I try to "link" instead of "signIn" as you mentioned.
5. But i can't link because there is no "currentUser" yet.

I'm afraid this may be a general issue not related to SDK's. Any idea about this?

[prik2693]

Hi I m using firebase auth for my web application.
After enabling multiple account for same email,if i login with google with an email id and then try login with email (with the same email id),i get password as provider instead of gmail.Can anyone help me resolving the issue?

[mik-ro]

@macsinte I'm facing the same problem. When I try to link new Google account with FB or email account already created Firebase overrides those accounts and only new Google account persists. Has anyone overcomed that issue?

[assafshp]

This happens to me also. From email account if the email is not verified, then google overrides this provider. But you can simply add the email verification feature and in case that the user approved his email, google account provider will be added and not overwritten. As for FB, I still don't know why google provider always overrides.

[leoggonzalez]

I'm getting this exact issue when I allow multiple accounts with same email.

I only want certain custom domain email accounts to login into my app.

But if a user is already registered with email/password and then tries to login with Gmail, I can't get the email information.

ALSO: I don't know if this is intended or not, but if a user signs in with Facebook and then tries to recover password, clicking on the password recovery link changes the auth method to email/password and cannot be changed back.

[nicks258]

Any idea how to resolve this.

[strikejr12]

samtstern, can you provide the link which this issue is currently going on? Thanks in advance.

[jamesamuel]

Still seems to be an on-going issue! @davideast any ideas?!

[paulsenjs]

hi guys, do we have any solutions for this issue ? the issue still occur in 2018.

[miszmaniac]

We're having the same problem.
Google and Facebook accounts don't merge as expected in docs

[paulsenjs]

Finally i did some tricky ways to solve the issue. The problem is, FirebaseUser will return null for email, so i got it from callback GoogleSDK and FacebookSDK. Yes, that way not merge the accounts on Firebase Dashboard, but at least i can get the email account after log in from Facebook and Gmail by using the similar account.

[chris833]

It works for me adding scope 'https://www.googleapis.com/auth/userinfo.email'.
I have facebook, google and twitter accounts with same email address and y get the email in user.providerData.email not in user.email.

[r-schipper]

Another way to retrieve the email is by setting the provider and adding a scope, like this:

var provider = new firebase.auth.GoogleAuthProvider();
provider.addScope('email');
this.$.auth.signInWithPopup(provider).then(function (response) {

With this you can retrieve the email from response.additionalUserInfo.profile.email.
Here is some more info about it: https://firebase.google.com/docs/reference/js/firebase.auth.Auth#signInWithPopup

[Brahmadatta]

Environment:

• Android device: Nexus 6P
• Android OS version: Android N
• Google Play Services version: 9.4.0
• Firebase/Play Services SDK version: 9.4.0
• FirebaseUI version: 0.5.3

The problem:
Signing up with the same email address via two different providers (Facebook and google), is resulting in two different users, but only one having the email address.

Steps to reproduce:
With 'Multiple accounts per email address' enabled, and Facebook and Google signup providers working (and capturing emails) for fresh users.

1. Signup as a new user with either provider, (firstly removing any previous firebase accounts with the same email).
2. Notice the users email was captured in the firebase console.
3. Logout and signup via the alternative provider, using an account that has the same email as step one.
4. Notice firebaseUi proceeds, but creates a new firebase user without an email address
5. What is strange is that alternating between the provider I try from fresh, both Google and Facebook can capture the email, but not after an account with the email has been made.

Expected Results:
I'm expecting the accounts to be joined together.
Am I wrong in assuming FirebaseUI should do this?
Disabling 'Multiple accounts per email address' is a great workaround considering that FirebaseUi notifies a user about an existing account, but it would be nice to get past this small issue if this repo is already capable.

I'm not seeing any logs for firebaseui, presumably because I'm not hitting any errors. Let me know if I should be or if I can provide any more detail.
Thanks for the help!

@ahaverty @samtstern @amandle @jashick @maksimluzik We can get email id though we use Gmail and Facebook authentication. I found a way to access email with same email logins for firebase

Just use this snippet in on success task from the firebase:

Map<String, Object> profile = task.getResult().getAdditionalUserInfo().getProfile();
Object email = profile.get("email"); //Obtaining the email from the use though we use same email form facebook and gmail accounts.

Thank you.

I hope this helps you. Can you give me feedback after you use this code? It helps me. @ahaverty

[Karthi-R]

Any solution for this issue?

[ubragg]

I'm seeing this now, too. Now sure why this bug is closed.

If I log in with Google, then Facebook with the same email address, it fails 100% repeatably with "Developer error" (of all things).

The same combination fails on iOS (see firebase/FirebaseUI-iOS#675) and web versions of FirebaseUI too, although on the web if I sign in with both Google AND Apple first, I can oddly sometimes get a Facebook login to work.

What the heck is going on here, and why is this ever order dependent?

Update: I found firebase/firebase-ios-sdk#5344 (comment) which explains the issue. But I'm still left wondering why there isn't better user-facing error messaging built into Firebase UI when this issue arises. A random "Developer error" isn't useful for the developer or the user - why not just flow into the path that verifies the email and makes it possible to link Facebook to Google? (Or does that work if I implement the email/password flow?)

[katowulf]

The issue described here is a problem with the SDK. Discussing it on the issue tracker for the Firebase UI library will be fruitless. Locking further discussion so you don't waste your time.

See also:
firebase/firebase-android-sdk#25
https://stackoverflow.com/questions/37947944/authentication-using-facebook-at-first-and-then-google-causes-an-error-in-fireba
https://stackoverflow.com/questions/53516585/firebase-authentication-only-converts-facebook-and-email-auth-to-google-auth-bu