Skip to main content

User account linking

Ory allows users to link their accounts to social sign-in providers after they sign up, as well as un-link social sign-in providers they previously added.

info

Users can link their accounts only to social providers you configured in your Ory project.

Users can use account linking and un-linking:

  • to start signing in with a profile created in a social sign-in provider when they originally signed up with email and password
  • to link another social sign-in provider to their profile so that they can sign in with their GitHub profile and their Facebook profile
  • to remove a social sign-in provider link from the profile (possible only when multiple sign-in methods are available to prevent locking users out from accounts)

Linking accounts​

Users can link accounts manually through their account's settings page. To try out account linking, use the Ory Account Experience. Follow these steps:

  1. Configure at least two sign-up methods in your Ory project. One of these methods must be through a social sign-in provider.
  2. Go to your project's Ory Account Experience at https://{project.slug}.projects.oryapis.com/ui and sign up.
  3. After you sign up, go to Account Settings and navigate to the Social Sign In section.
  4. Select one of the buttons to link an available social sign-in provider.

Un-linking account​

Users with multiple sign-in methods can un-link social sign-in providers from their account through their account's settings page. To try out account un-linking, use the Ory Account Experience. Follow these steps:

  1. Go to your project's Ory Account Experience at https://{project.slug}.projects.oryapis.com/ui and sign in with a user account with multiple sign-in methods available.
  2. Go to Account Settings and navigate to the Social Sign In section.
  3. Use the buttons to un-link a social sign-in provider.

Automatic account linking​

While it is convenient for users, automatic account linking creates an attack vector that can allow malicious actors to steal user accounts.

danger

Since it constitutes a security threat, automatic account linking is not available in Ory.

To better understand the danger, consider the following scenario:

  • Your application allows users to create new accounts or sign in with ACME - a well-known social sign-in provider.
  • John creates a new account in your application using his john@doe.com email.
  • Malicious actors know that John uses john@doe.com to sign in to his account in your app.
  • Malicious actors create an ACME account for john@doe.com.
  • Malicious actors sign up in your application using the ACME account created for the john@doe.com account.
  • Your system uses the default behavior and when it detects two accounts with the same identifier, malicious actors are asked to link the accounts.
  • Malicious actors link the accounts.
  • Malicious actors get access to the account that John created manually using his john@doe.com email.