gotrue: Unable to signIn with OpenIDConnect when already signed Up with email and password

Bug report

Describe the bug

I am unable to link/sign in with OpenID using the same email as an account signed up with email and password. When looking at supabase logs I see, duplicate key value violates unique constraint "users_email_key"

To Reproduce

I sign up with email and password and I then click the verification email. I verify that the row looks good in auth.users.
I then create an account using OpenIDConnect. The error I get back is GotrueError(message: Database error saving new user)

let response = await supabase.auth.signUp({
  email: 'someone@email.com',
  password: 'RQTFSUtvkVqRfzemYsPI'
})

let response = await supabase.auth.signIn({
  oidc:{
      id_token: 'valid_id_token',
      nonce: 'valid_nonce',
      provider: 'google'
  }
})

They work separately, but they fail when called after each other.

Expected behavior

I expect that I can sign in with oidc when the email is the same as an account that has already same up with email and password.

About this issue

Original URL
State: open
Created 2 years ago
Reactions: 3
Comments: 18 (8 by maintainers)

Commits related to this issue

feat: add experimental `signInWithIdToken` for Apple, Google (#603) Adds `signInWithIdToken` as experimental. This brings back the ID token login flow for [Sign in with Apple](https://developer.app... — committed to supabase/gotrue-js by hf a year ago

Most upvoted comments

Hey everyone, the team and I discussed this at length. Here’s our conclusions:

We recognize this is being used in the wild and is a hard requirement on iOS.
The current implementation has some (serious) known issues and we don’t want to encourage people to be using something that is of low quality.
Mid-term we do want to add official support for an OIDC login flow (that uses ID tokens), but this is unlikely to be backward compatible with what we have today.

Thus we decided to do the following:

Add back support for this flow in v2 of gotrue-js, but under an @experimental annotation. We’re going to be allocating some time to do this in the next 2 to 3 weeks.
Since Sign-in with Apple is a hard requirement in mobile apps on iOS, we’ll try to address some of the known issues in that flow only. Since we’re busy with some other priorities, we can’t promise a timeline on addressing this.
Any PRs from the community on this topic will be considered closely, in an effort to unblock you.
Once we address OIDC ID token login flows properly, the existing flow will be deprecated and the existing API is likely to be removed with some prior notice. Prepare your codebase for such an eventuality in the future.

Feel free to let us know how you feel about this or if we should reconsider something. Thank you for your dedication so far!

hf on Oct 22, 2022

Hey everyone! Here’s the PR: https://github.com/supabase/gotrue-js/pull/603

Sorry this took so incredibly long!

hf on Feb 2, 2023

Hey, this was maybe prematurely communicated. We’ll discuss with the team tomorrow and give an update. You’re right about supporting existing use cases.

hf on Oct 19, 2022

@hf: It is now almost the end of January and I would like to politely ask if you have made any progress in the matter? Is there anything we can do to support you? 😃

megacherry on Jan 27, 2023

@megacherry Hey not yet since we’ve been busy preparing stuff for Launch Week 6. https://supabase.com/launch-week

We’re going to start planning our next steps in January and this (OIDC support) is high up on our list.

hf on Dec 6, 2022

I will actually be very upset if the endpoint to support oidc is removed. I and many others have spent a lot of time to support OIDC. It’s required for native auth and I really hope we get clarification on what’s happening. @hf @kangmingtay

DanMossa on Oct 19, 2022

I think adding OIDC in v2 is important. Especially for google one tap login

planktonrobo on Nov 20, 2022

Exactly. It seems like not much thought may have gone into the decision to remove OIDC. There’s also not that many bugs that exist. Adding OIDC was a long process but we’re slowly getting there. Most things are fixed and all that’s left is a little bug fixing. PLEASE don’t remove code for this.

DanMossa on Oct 17, 2022

Forgive my ignorance, but if OIDC is removed what happens to users who’ve created their account using Apple/Google auth? How will they sign in to the app if they can’t use their email and password? And, how will we do native sign-in?

WJimmyCook on Sep 30, 2022

Hey, due to issues with the quality of implementation for OIDC we’ve decided to stop supporting it and removed it from the v2 version of the client library all together.

It’s been a while, but if you could attach some logs from the failing operation we may be able to look into this issue further. Until then, I’ll close it.

hf on Sep 26, 2022