If I use OpenID Connect or OAuth2 for authentication, and a customer deletes his/her OAuth2 provider (Facebook) account, how can I safely associate a new authentication with a different OAuth2 provider to the old account so that the customer does lose their stored information? Do I need to set up some alternate means of authentication at account creation time?
I was thinking that as part of the registration with their original OAuth2 provider (e.g. Facebook), I would request their email address from Facebook and store that. Later, when their Facebook account is deleted, can I just have them re-register, say with Google+, Twitter, LinkedIn, or some other OAuth2 (OpenID Connect) provider that I accept, request the email from that new provider and then simply associate the new account with the old account registered under Facebook? Is this safe from a security standpoint? It depends on the email address really being theirs and that the OAuth2 providers verified that.