OpenID Connect, OAuth2, and deleted accounts

Question

If I use OpenID Connect or OAuth2 for authentication, and a customer deletes his/her OAuth2 provider (Facebook) account, how can I safely associate a new authentication with a different OAuth2 provider to the old account so that the customer does lose their stored information? Do I need to set up some alternate means of authentication at account creation time?

I was thinking that as part of the registration with their original OAuth2 provider (e.g. Facebook), I would request their email address from Facebook and store that. Later, when their Facebook account is deleted, can I just have them re-register, say with Google+, Twitter, LinkedIn, or some other OAuth2 (OpenID Connect) provider that I accept, request the email from that new provider and then simply associate the new account with the old account registered under Facebook? Is this safe from a security standpoint? It depends on the email address really being theirs and that the OAuth2 providers verified that.

Answer 1

I was thinking that as part of the registration with their original OAuth2 provider (e.g. Facebook), I would request their email address

You can try to use the e-mail address as a unique key, and it might mostly work, but it's fraught with problems.

1. If the user registers with a Google Account or a Yahoo account, the provided E-Mail address will most likely be tied to the account. So when the account gets deleted, the E-Mail address perishes, too.

2. If a user deletes an account from an identity provider that is also providing the user with his e-mail address (see point 1), then a simple attack becomes possible: Eve can register a new account with the identity provider and reactivate the e-mail address, but now it will belong to Eve instead of the original user.

3. There is no guarantee that different identity providers will send you the same e-mail address for a given user. In fact, it's rather unlikely. So you won't be able to identify the "same" user based on the e-mail address in the ID token.

If you really need to have a user access his account despite his having deleted the account he usually logs in with, you need to set up an alternative form of authentication before he deletes the account. For example, you could let him link his account with multiple identity providers, provide him with an emergency "access token" that can be used to redeem an account (either directly or by asking for his phone number of an alternative e-mail address), or use any of the security question schemes other sites use.