如何处理同一用户的多个openID
对于我的网站，我使用的登录系统与 SO 上的非常相似。用户可以使用 Facebook、Google（Gmail openID）、Twitter 帐户登录。
这个问题与特定的 oAuth 或 openID 实现无关。
问题是如何知道同一用户是否通过不同的提供商登录。
让我举个例子：
Bobo通过点击“使用 Facebook 登录”来登录网站。。因为这是他第一次来访，我们为他创建了一个帐户。
后来Bobo来到了该网站。这次他点击了“使用 Google 登录”。那么我如何知道这是否是同一个人，以便我可以将此提供者添加到他的帐户中，而不是创建一个新的（和重复的）帐户。
我可以只信任电子邮件吗？
处理这个问题的最佳方法是什么。那么如何做到呢？
有什么想法吗？
编辑： 如果我信任电子邮件，同一电子邮件是否有可能被不同用户使用？这可能是一个安全问题吗？
For my site I am using a login system much like the one on SO. A user can login with his Facebook, Google (Gmail openID), Twitter account.
This question is not about specific oAuth or openID implementations.
The question is how to know if the same user logins with different providers.
Let me give an example:
Bobo comes to site logins to site by clicking on "Login with Facebook". Because this is his first visit we create an account for him.
Later Bobo comes to the site. This time he clicks on "Login with Google". So how do I know if this is the same person so I can add this provider to his account instead of creating a new (and duplicate) account.
Can I trust solely on email?
What is the best way to handle this. How does SO do it?
Any ideas?
Edit:
If I trust on email is there a possibility that the same email can be used by different users? Can this be a security issue?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
我认为除非用户再次明确表示这是 Bobo，否则您无法真正知道这一点。他的 FB 和 Google OpenID 身份可能具有完全不同的信息（和我的一样）。只有Bobo知道这些是同一个人的。
请参阅此处的 SO：您使用 OpenID 登录，然后可以将另一个 OpenID 链接到您的帐户。提示您的用户也这样做。在登录过程中提供足够大的“我在这里已经有一个帐户”按钮。
I think you can't really know this unless the user explicitly says it's Bobo again. His FB and Google OpenID identities may have completely different info (as do mine). Only Bobo knows that these belong to the same person.
See how it's done here at SO: you log in with OpenID, then you can link another OpenID to your account. Hint your user do so, too. Provide a large enough "I already have an account here" button in the login process.
除非两个帐户提供相同的电子邮件地址，否则您将无法可靠地确定它们是同一用户。
如果您希望用户能够使用多个 oAuth/OpenID 帐户登录，您可以提供一种机制来允许用户从其用户帐户添加其他身份验证。
Unless both accounts provide the same email address, you would not be able to reliably determine that they were both the same user.
If you want a user to be able to login with multiple oAuth/OpenID accounts, you could provide a mechanism to allow the user to add additional authentications from their user account.
转到此网站上您的个人资料，在您的详细信息上方，您将看到 2 个链接：编辑|添加 openid
通常您将有 1 个用户 = 1 个登录详细信息（登录名/密码与其余信息存储在一起）。在这种多 ID 的情况下，您必须单独存储登录详细信息（1 个用户可能拥有多个登录 ID）。数据库表之间的简单一对多关系。
Go to your profile on this site, there, above your details, you will see 2 links: edit | add openid
Usually you will have 1 user = 1 login details (login/password stored together with the rest of info). In this multi-id situation you have to store login details separately (1 user may have more than 1 login id). Simple 1-to-many relation between DB tables.