I'd love to see a user field to link-up existing drupal users to openids and a way to reconcile users who login with an openid
not linked to a drupal account rather than creating two accounts (ie if their email addresses are the same).

And of course the strategy documented somewhere. I'm not exactly sure what is happening now, but it appears
that you can create two accounts, one normal, and another openid account, both with the same email address.

Comments

jvandervort’s picture

jvandervort commented

Also, the openid string and the local account alias should not be linked in any way.

So if

jvandervort@myopenid.com logs in and is not associated with an drupal account
1. present an interim login screen which has user id and email (prefill jvandervort if available)
2. on submit, make sure the email and the account don't exist, then create.
3. if either the email or the account exist, tell people to login to their local account and associate this openid with their drupal account, or choose a unique account AND email.

We want to avoid BillGates@microsoft.com and BillGates@spammer.com from confusing folks.
Could be a admin setting to allow dup openid prefixes.

anarcat’s picture

anarcat commented
Title: Account handling » Improve account handling on unknown openid URLs

So I agree this is a problem, for me it's particularly obvious when new account creation is controlled by the administrator of the site: you should get a login screen that directly attaches your account to your openid when you use a new openid.