如何将两个 OpenID 提供商关联为同一用户
我已经在我的网站上实现了 OpenID，我很好奇 stackoverflow.com 等网站如何知道我的 Gmail 帐户已链接到我的 Facebook 帐户。
例如，我第一次访问 stackoverflow.com，并使用我的 Gmail 帐户登录。然后我注销，清除浏览器中的 cookie，然后返回 stackoverflow.com，但这次我使用 facebook 而不是 gmail 登录。不知何故，stackoverflow.com 知道我的 Facebook 帐户已链接到我的 Gmail，因为我的所有用户设置都从我第一次使用 Gmail 登录时恢复。显然 stackoverflow 知道我的 Gmail 和 Facebook 帐户都是我的。
回到我的实现：当我使用 gmail 或 facebook 登录用户时，我会收到来自 RPX 的回复，其中包含一些用户信息，例如他们的姓名和电子邮件地址。可以肯定地说，如果我有一个用户使用其 gmail 帐户登录我的网站， [电子邮件受保护]，然后使用其 Facebook 登录，其 Facebook 帐户也使用 [email protected] 他们实际上是同一个人？
其他人也是这样实现同样的目标的吗？
I've implemented OpenID on my website and I'm curious how sites such as stackoverflow.com can tell that my gmail account is linked to my facebook account.
E.g. I come to stackoverflow.com for the first time and I sign in using my gmail account. Then I log off, clear cookies from my browser and go back to stackoverflow.com but this time I log in using facebook instead of gmail. Somehow stackoverflow.com knows that my facebook account is linked to my gmail, because all of my user settings are restored from when I first signed in with gmail. So obviously stackoverflow knows that my gmail and facebook accounts are both ME.
Back to my implementation: When I log in my users using gmail or facebook, I get a post back from RPX with some user information such as their name and email address. Is it safe to say that if I have a user that logs into my website with their gmail account, [email protected], and then logs in with their facebook and their facebook account also uses [email protected] that they are in fact the same person?
Is this how other people accomplish the same goal?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
我想说，可以安全地假设两个具有相同电子邮件地址的人是同一用户。
另一种方法是提供链接网站上两个帐户的功能。我的意思是说，我已经看到社交身份验证的实现，如果您使用 OpenID 或 Facebook 登录，每个身份验证都将是一个单独的实体。在用户尝试使用不同的系统登录之前，您可以提示他们连接到他们的 Facebook/Twitter/OpenID 帐户。一点点社会工程学可能会帮你解决很多问题。如果他们不连接，然后继续单独登录，那么您当然会遇到问题。我突然想到，TripIt 允许您将单独的帐户合并为一个。您可能会提供此功能。
只是一些想法。
I would say that it is safe to assume that two people with the same email address are the same user.
Another way to go about this would be to provide functionality to link the two accounts on your site. What I mean to say is that I've seen social authentication implemented where if you log in using OpenID, or Facebook, each would be a separate entity. Before the user attempts to use a different system to log in, you could prompt them to connect to their Facebook/Twitter/OpenID account. A little bit of social engineering might save you a lot of problems. You'd of course have an issue if they don't connect, and then proceed to log in separately. Off the top of my head, TripIt allows you to join separate accounts into one. You might provide this functionality.
Just some thoughts.