I am adding Single Sign-On (SSO) via Google and Microsoft identity providers to a web application where many thousands of user accounts already have existing credentials stored by username and password. Each account also has a primary email address separate from its username. Users can reset their passwords by requesting a link sent to the primary email address. Therefore, as with most web applications, access to the account's email address effectively grants access to the application.
In this context, would it be good practice to log users into their accounts after a successful SSO authentication based solely on the email address returned by the SSO response's OAuth claims matching the email address of an active account?
Note that we will also offer a feature allowing existing users to explicitly link their accounts to SSO via Google or Microsoft using the permanent unique OAuth 2.0 Subject ID. This will be done after successful login using their legacy credentials. By contrast, my question above is about whether to allow an ad-hoc SSO login to an unlinked account based on a matching email address. The obvious advantage to this is convenience: users will not need to take an extra step after the SSO login to enter their existing credentials for my application. But I can also think of some potential drawbacks:
- If a user successfully authenticates via SSO, say to a Google account for firstname.lastname@example.org, the user does not necessarily control that email address (particularly if it's a non-GMail address.) So I could be granting access to my application to an unauthorized user. This seems unlikely but theoretically possible.
- If the user changes their email address, either in my application or at their SSO provider, we could lose the ability to match. Of course, this would be resolved by explicitly linking the SSO account as described above.
I have found that there is far less guidance on integrating SSO providers with existing legacy websites than there is on integrating SSO when building websites from scratch!
Edit: Further background on email verification in SSO - I noticed that the Google JWT response includes an email_verified boolean claim that is always true. It appears that this is part of the standard OpenID Connect specification and indicates that the user controls the email address. Microsoft's SSO implementation has a similar (optional?) claim. I assume that if this claim is true, my application could be confident in granting access to any account matching the email address, right?