2

I'm wondering if it's possible to deal with a login mechanism that is dependent on the user identifier.

For example, the user can have access using OpenId, OAuth or token. But how can we "help" the user to determine which mechanism they can use?

For the moment the rest of my team want to expose the auth mechanism after the user gives the username to help to choose the right authentication mechanism.

For me, this is a bad idea, because someone can guess the validity and get info about a user without entering the password. But maybe there is a way to do it?

One option is to use email as "gate". The user needs to click to a link in his email to get the proper login mechanism.

1

I'd listen to your developers. The whole point of identity federation is that you delegate authentication to the underlying identity management system. Perhaps one is a simple username/password sign in while another uses two factor auth.

Besides, what info do you really need to protect? The fact that bob@gmail.com is a gmail account?

If you're determine not to give anything away, there's nothing to stop you forcing the user to be explicit about their domain before they provide their username. That's a common enough approach.

E.g.

  • Sign in with Google
  • Sign in with Facebook
  • Etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.