Swift: Linking Facebook users with existing PFUsers Not Working on Parse Server

[dnadri]

Issue Description

I'm trying to integrate the Facebook login/signup into my app to work alongside the standard login/signup with email. I am using Swift and have migrated to MongoDB + Parse Server (deployed on Heroku).

I've followed the Parse iOS guide on Facebook Users. However, with Parse Server, the Facebook integration isn't working normally according to all the tutorials and documentation out there. I have already looked for a solution to this issue on Stackoverflow and others (original SO post).

1. How can I link existing PFUsers with their Facebook accounts when they log in with Facebook in the app?

I am using the Swift code from this section of the guide to associate an existing PFUser to a Facebook account (see code below), however, this code is not executing and therefore is not linking a users existing account they created through the email sign up with their Facebook account which has the same email.

The isLinkedWithUser method seems to require that the user be logged in. However, when a user is signed out/just downloaded the app, the PFUser.currentUser() is nil because the user is not logged in. Therefore, the linkUserInBackground method won't know which PFUser to link the Facebook account with. I believe these methods are now useless at least this case because they are meant to link after the fact (after they log in). But I don't want to create two users even if I handle this situation afterwards.

2. Is there a Cloud Code example or other Swift logic to accomplish this?
3. Has Parse addressed this issue? Should the developers use the official Facebook SDK for Facebook login? If so, how can they link existing PFUsers to their Facebook accounts during Facebook login?

Thank you in advance for your time and patience. I greatly appreciate any help!

Code

func fbLoginButtonTapped() {

let permissions = ["public_profile", "email"]
PFFacebookUtils.logInInBackgroundWithReadPermissions(permissions, block: {
    (user: PFUser?, error: NSError?) -> Void in

    if let user = user {
        if user.isNew {
            print("User signed up and logged in through Facebook!")
        } else {
            print("User logged in through Facebook!")

            // This API doesn't seem to be working with Parse Server
            if !PFFacebookUtils.isLinkedWithUser(PFUser.currentUser()) {
                PFFacebookUtils.linkUserInBackground(PFUser.currentUser(), withReadPermissions: nil, block: {
                    (succeeded: Bool?, error: NSError?) -> Void in
                    if error == nil {
                        print("Woohoo, the user is linked with Facebook!")
                    } else {
                        print("User is not linked with Facebook.")
                    }
                })
            }

            dispatch_async(dispatch_get_main_queue(), { () -> Void in
                let viewController = UIStoryboard(name: "Main", bundle: nil).instantiateViewControllerWithIdentifier("HomeNavigationController") as! UINavigationController
                self.presentViewController(viewController, animated: true, completion: nil)
            })

        }
    } else {
        print("User cancelled the Facebook login.")
    }           

}

Expected Results

Link an existing PFUser to a Facebook account during Facebook login.

Actual Outcome

No linking of Facebook user to existing PFUser even if the emails are the same. Two PFUsers with the same email exist, only the Facebook user has a randomly generated username (etc) because this part hasn't been implemented yet.

Environment Setup

• Server
  Parse Server deployed on Heroku.
• Database
  mLab MongoDB.

[flovilmart]

Linking is reserved for usage when you have an existing user. This existing user can have signup with email (signup), or with twitter, or anonymous thought the login methods.

If you call login with Facebook or Twitter utils, that will discard the current user and effectively create a new user if it doesn't exist, based on the id provided by Facebook or twitter. If the user exists in the DB, based on the Facebook id or twitter id, this user will be logged in and available through PFUser.currentUser().

For what you want to achieve, you have multiple options:

1. make sure the user is signed up through email before calling loginWithFacebook. If the user is logged in with the email, you can call link, in order to allow the user to use both authentication methods (Facebook and email). Repeat with twitter and other configured methods.
2. If users come into your app with a Facebook login, use the loginWithFacebook method and then prompt to set an email and a password and save that user.
3. if the user is effectively logged out and uses Facebook, then logs out and uses twitter, and you want to reconcile those accounts, you need to do it manually. That usually involves moving the authData from each account to a centralized on. Reset ACL's on all objects owned by the wrong accounts etc... And finally delete the users, and sessions. Next time the user will want to use your app, you want to have a mechanism to prompt for login again if you merged the authentication data on an account that is currently not logged in on the device. To sum up, that is a highly custom behaviour.

Why don't we link on email automatically?

Because the email without the password is unsafe and can't be trusted. An attacker with a valid Facebook account could impersonate any user, allowing them to link just by providing the email.

[dnadri]

@flovilmart Thanks for your comment! I emailed you to follow up directly.

[dnadri]

@flovilmart Did you receive my email? I would like to clarify a few things in regards to this issue.

[flovilmart]

If there is more things to clarify, this discussion should happen on github and not in private.

[dnadri]

Thanks for getting back. @flovilmart, @drew-gross or anyone else familiar with this topic:

1. If linking is reserved for usage when you have an existing user, is there another way to link Facebook login users to their existing accounts created via email sign up when the existing user is not logged in?

2. If you call login with Facebook or Twitter utils, that will discard the current user and effectively create a new user if it doesn't exist, based on the id provided by Facebook or twitter.

   By "doesn't exist", are you only referring to a Facebook account that doesn't exist? If so, what about a PFUser account that exists from email sign up? In this case, I believe you are saying that even if a user has created an account via email sign up, a new user will be created via Facebook login even if the email used with email sign up and Facebook login are the same, correct?
   If so, this is not what I want to achieve. I don't want the PFFacebookUtils.logInInBackgroundWithReadPermissions call to create a new a new user if this is the case. This leads back to my first question (1.)

3. make sure the user is signed up through email before calling loginWithFacebook.

   a) How does one make sure the user is signed up through email?
   b) By "loginWithFacebook", are you referring to the PFFacebookUtils.logInInBackgroundWithReadPermissions method?

   c)

   If the user is logged in with the email, you can call link, in order to allow the user to use both authentication methods (Facebook and email).

   Correct, I understand that linking can be done after-the-fact (once user is logged in). However, my goal is to achieve linking before the user is logged in (when they are on the login/sign up page) of the app.

4. If users come into your app with a Facebook login, use the loginWithFacebook method and then prompt to set an email and a password and save that user.

   One of the benefits of Facebook login is that users don't have to set an email and password - it uses their Facebook credentials to seamlessly verify and login users. I already have the user entering their email and password during regular email sign up.

5. if the user is effectively logged out and uses Facebook, then logs out and uses twitter, and you want to reconcile those accounts, you need to do it manually.

Note: The app will not be using Twitter login integration. Only Facebook login integration, alongside regular email sign up.
Clarification: If the user has created an account before using regular email sign up, is logged out, and then uses Facebook the next time to login, I want to reconcile those two Facebook and regular email accounts.
How can I achieve this manually?

Example: Here's a screenshot of two users (same person), Facebook login user (on top) and regular email sign up user (on bottom), with the same email (even though the Facebook user's email field is "(undefined)"...I did not implement code to set this information for Facebook users yet). The goal here is to link/merge these accounts into one to avoid having multiple accounts with the same email. Regular email sign up prevents this, however, currently through Facebook login, the same person who created an account through regular email sign up can create another account through Facebook even though both accounts would have the same email. Note: The "authData" field is "(undefined)" for all regular email sign up users.

Summary:
Ultimately, my goal is to have the following login/sign up flow when a user taps the Facebook login button while logged out or for their first time ever:

• If the user is a new user (where no account with the given email exists - whether through email sign up or Facebook login), sign up the user via Facebook login (create a new account);
• If the user is not a new user (an account with the given email already exists - whether through email sign up or Facebook login), log in the user via Facebook login. However, if the account which already exists was created through email sign up, link the existing email sign up account with the user's Facebook account that was just logged in with (or update the existing email sign up account with the user's Facebook profile information retrieved from a Graph request);
• Otherwise, cancel the login (do not create a new user).

I am very thankful for your time and assistance in trying to resolve this issue.

[dnadri]

@flovilmart, @drew-gross or anyone else: Would love to hear each of your takes on this when you get a chance. Thanks!

[flovilmart]

@dnadri I believe you should get your answer on stackoverflow as it's clearly not an issue with parse-server but an implementation detail.

We have no plan to implement this kind of feature anytime soon, but if you're willing to contribute a solution, feel free to open a pull request.

[acegreen]

@dnadri did you find a solution to this? If so, could you post it for reference?