Important error – mixing identities
-
Hi @auth0josh,
I’ve found this error using Login by Auth0 wordpress plugin but I can recreate it with Auth0 API.
Using Auth0 API I can get user by id, the problem is, that the same id is used among different database connections but getting the user by id I don’t specify which connection I want to use therefore I can get wrong identity.
For example:
I have one email address and I use it to create accounts in different database connections (one email address has many identities).
Using the API /api/v2/users-by-email I pass ‘[email protected]’ and I get something like this:
[ { "username": "foo_1", "email": "[email protected]", "user_id": "auth0|1", ... "identities": [ { "user_id": "1", "provider": "auth0", "connection": "CONNECTION_1", "isSocial": false } ], ... }, { "nickname": "foo_2", "email": "[email protected]", "user_id": "auth0|1" ... "identities": [ { "user_id": "1", "provider": "auth0", "connection": "CONNECTION_2", "isSocial": false } ], ... }, { "email": "[email protected]", "name": "foo_3", "user_id": "auth0|1", ... "identities": [ { "user_id": "1", "provider": "auth0", "connection": "CONNECTION_3", "isSocial": false } ], ... } ]Then I run GET
/api/v2/users/{id}and pass auth0|1 and get one of the three identities. I don’t have to specify which connection to use:{ "nickname": "foo_2", "email": "[email protected]", "user_id": "auth0|1", ... "identities": [ { "user_id": "1", "provider": "auth0", "connection": "CONNECTION_2", "isSocial": false } ], ... }This error affected my wordpress sites too.
Recently I’ve set up new wordpress installation with Auth0 plugin. I’ve registered new user account there (let’s say [email protected]) and I’ve found that I cannot log in there. I’ve changed passsword and logged into that account only to find that wordpress is showing me another identity form another connection that was disabled for this application (let’s say [email protected]).In Auth0 dashboard, in logs section I’ve found that [email protected] was logging to my new wordpress. In Auth0 dashboard users section I’ve also had [email protected] at the top of the list but when I’ve clicked I saw the [email protected] identity and in [email protected] account History section I saw logs indicating that this account logged to my new wp site too. The get_user and login migration scripts were returning the identity for [email protected]
-
Two more things
1) I’ve turned on Implict Login Flow on a WordPress site that is configured as Auth0 application that allows Auth0’s database connection with database migration. I’ve logged in to that site with an email that is used in two databases connections with migration. With implict login flow I saw the right email in my user’s profile but when i checked on Auth0 dashboard I saw that the latest login was from the second database connection linked to that email but that database connection wasn’t allowed for my application.
EDITED: I’ve chcecked auth0 dashboard logs too and in logs it states that it was the right account – so only the users list is corrupted.2) In Auth0 dashboard if I search by by email I only see an an account once although it is in two databases.
I’m not sure I totally understand. Can you give me a little more detail here?
I have these two accounts, that were mixed in wordpress:
[ { "email": "[email protected]", "email_verified": true, "nickname": "spam", "name": "[email protected]", "user_id": "auth0|2599", ... "identities": [ { "user_id": "2599", "provider": "auth0", "connection": "CONNECTION_1", "isSocial": false } ], ... "logins_count": 6 } ][ { "email": "[email protected]", "email_verified": false, "nickname": "foo", "name": "[email protected]", "user_id": "auth0|2599", ... "identities": [ { "user_id": "2599", "provider": "auth0", "connection": "CONNECTION_2", "isSocial": false }, { "profileData": { "email": "[email protected]", "email_verified": true, "nickname": "foo" }, "user_id": "2611", "provider": "auth0", "connection": "CONNECTION_1", "isSocial": false } ], ... "logins_count": 28 } ]I go to https://manage.auth0.com/ > Users&Roles > Users
I click on [email protected] but I get [email protected]I’m not seeing that behavior on my end:
Check the response from the API above for [email protected].
I would expect to get both [[email protected] & CONNECTION_1] and [[email protected] & CONNECTION_2]. Am I right or maybe that is correct behavior? I get:
identities.connection:"CONNECTION_1"
[foo@bar & CONNECTION_2]
…email:"[email protected]"
[foo@bar & CONNECTION_2]I would expect [foo@bar & CONNECTION_1] for this one:
identities.connection:"CONNECTION_1" AND email:"foo@bar"
[foo@bar & CONNECTION_2]
The topic ‘Important error – mixing identities’ is closed to new replies.
