Omniauth：映射用户
我有一个关于使用 Omniauth 构建用户系统的一般性问题：当我启用多种身份验证方法时，我想确保用户无法通过其他提供商再次注册 - 无论是意外还是故意。我的尝试是检查电子邮件地址，这对大多数提供商都适用。
但是，当我通过 Twitter 添加身份验证时，该系统会失败，因为 Twitter 不会发布用户的电子邮件。
因此，我能想到的唯一方法是在通过 Twitter（或任何其他不发布电子邮件的登录提供商）登录时添加注册的第二步，我只是想知道是否有更方便的方法这？
任何帮助或建议表示赞赏！
I have a general question about building a user system with Omniauth: When I enable more than one authentication method I want to make sure, that a user can't sign up again through an other provider - whether it's accidentally or on purpose. My attempt was to check the email address, this is what works for most providers.
But when I add authentication via Twitter this system fails since Twitter won't publish the email of the user.
So the only way I could figure out was to add a second step of registration when signing in via Twitter (or any other login provider that doesn't publish the email) and I'm just wondering if there are any more convenient ways to do this?
Any help or suggestions are appreciated!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您在使用 LinkedIn 时也会遇到同样的问题。另外，我个人对我加入的每个网站都使用不同的电子邮件。因此，即使您索要我的电子邮件，也无法帮助您识别我的身份。如果您仅使用 Omniauth 而未使用 Devise，您可以在每次用户登录时检查他们是否也使用其他服务登录并合并帐户。但这似乎没有必要，因为人们通常一直登录他们的 twitter/fb 帐户。只要您在提供注册页面之前检查两者，您就应该是黄金。如果您真的想阻止人们拥有多个帐户，您要么需要要求并验证手机号码，要么严格依赖单个提供商。
You will have the same issue with LinkedIn. Also, I personally use a different email for every site I join. So, even if you requested my email that would not help you identify me. If you are only using Omniauth and not Devise also, you could check every time the user logs in to see if they are logged in with other services as well and merge the accounts. That seems unnecessary though because people are usually signed into their twitter/fb accounts all the time. As long as you are checking both before serving the registration page, you should be golden. If you are really trying to stop people from having multiple accounts, you either need to require and verify a cell phone number or rely strictly on a single provider that does.
您真正关心的是用户是否经过身份验证，一旦她/他经过身份验证，您只需跟踪经过身份验证的用户 ID 以及他们用于身份验证的服务。因此，如果一个人在 twitter 下登录并尝试在 Facebook 下登录，您的代码需要知道与该 twitter 用户关联的 user_id（不是 UID，如果您遵循 Ryan Bate 的railscasts），并且该 facebook 用户需要具有相同的 user_id。您仍然会让他使用第二个服务进行身份验证，但最后一步是检查 user_id 登录的服务（与他们刚刚登录的服务相对应）。如果服务不同，则意味着他们试图潜入第二个服务。而您可以处理它。
All you really care about is has the user authenticated and once s/he has, you only need to track the user id of who authenticated and what service they used to authenticate. So if a person is logged in under twitter and tries to log in under Facebook, your code needs to know the user_id (not the UID if you followed Ryan Bate's railscasts) associated with that twitter user and that facebook user needs to have same user_id. You will still let him authenticate using second service but final step will be to check what service user_id is logged in under (verses the one they JUST logged into. if the services are different it means they tried to sneak in under second service. and you can handle it.