"An account with the same identifier exists already" - But what's next?

[marcinkoziej]

Hi!
Successfully implemented Kratos browser self service flows. Thanks for awesome work Ory!

I have a question about a specific flow:

1. I have enabled password and oidc methods
2. I have registered an account for email + password with [email protected] email. I can sign in with user/password to this identity.
3. When I try to sign in using OIDC with google, and select [email protected], I receive and error and rightfully so: "An account with the same identifier (email, phone, username, ...) exists already.".

However, this error is shown on a Register page, and the OIDC register form has displayed input fields for identity traits (first name, last name, email). What does Kratos want me to do now? I cannot obviously register again using already used email. What would be the sense to provide other traits?
Shouldn't the right behaviour be to redirect me to login flow, but ask to log in via password method (and then maybe link the OIDC account?)

> kratos version
Version:			v0.5.4-alpha.1
Build Commit:	b02926c42aee2748bc37ce2600596bd0c2537a0d
Build Timestamp:	2020-11-11T13:00:29Z

The payload returned on register page using "get browser register flow" using the flowId provided by Kratos is pasted below.
You can see that the register form fields have values set to my first name, last name, email fetched from google. But for what reason? I can submit the form just to get the same error again,

{
  "id": "9bc83242-d38c-4910-ae5c-0808c2a0422f",
  "type": "browser",
  "expires_at": "2021-02-07T10:58:35.63459Z",
  "issued_at": "2021-02-07T09:58:35.63459Z",
  "request_url": "http://proca.lvh.me/self-service/methods/oidc/callback/google?state=2fe2d2b6-a3f6-4d64-a661-ebb56fb636ab&code=4%2F0AY0e-g74_3GkK17B5kF3RsDq9jR--_Zls4uh_8DIxH1a4CtGYY23ZDUwpbVY8ApQ2E3wkQ&scope=email+profile+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.email+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.profile+openid&authuser=0&prompt=none",
  "active": "oidc",
  "messages": null,
  "methods": {
    "oidc": {
      "method": "oidc",
      "config": {
        "action": "https://proca.lvh.me/.ory/kratos/public/self-service/methods/oidc/auth/9bc83242-d38c-4910-ae5c-0808c2a0422f",
        "method": "POST",
        "fields": [
          {
            "name": "csrf_token",
            "type": "hidden",
            "required": true,
            "value": "WAn2K8llgxiVrCoSK5y4ts/0hSoRDezUrwQYUsLEmYGZLYZStDITmef0e8aSyCnq/btuGwGCnLVj2Ynr89Q4KQ=="
          },
          {
            "name": "traits.email",
            "type": "text",
            "value": "[email protected]"
          },
          {
            "name": "traits.first_name",
            "type": "text",
            "value": "Marcin"
          },
          {
            "name": "traits.last_name",
            "type": "text",
            "value": "Ossowski"
          },
          {
            "name": "provider",
            "type": "submit",
            "value": "google"
          }
        ],
        "messages": [
          {
            "id": 4000007,
            "text": "An account with the same identifier (email, phone, username, ...) exists already.",
            "type": "error",
            "context": {}
          }
        ]
      }
    },
    "password": {
      "method": "password",
      "config": {
        "action": "https://proca.lvh.me/.ory/kratos/public/self-service/registration/methods/password?flow=9bc83242-d38c-4910-ae5c-0808c2a0422f",
        "method": "POST",
        "fields": [
          {
            "name": "csrf_token",
            "type": "hidden",
            "required": true,
            "value": "WAn2K8llgxiVrCoSK5y4ts/0hSoRDezUrwQYUsLEmYGZLYZStDITmef0e8aSyCnq/btuGwGCnLVj2Ynr89Q4KQ=="
          },
          {
            "name": "password",
            "type": "password",
            "required": true
          },
          {
            "name": "traits.email",
            "type": "email"
          },
          {
            "name": "traits.first_name",
            "type": "text"
          },
          {
            "name": "traits.last_name",
            "type": "text"
          }
        ]
      }
    }
  }
}

[vinckr]

Shouldn't the right behaviour be to redirect me to login flow, but ask to log in via password method (and then maybe link the OIDC account?)
Makes sense yes.

Wouldnt An account with the same identifier (email, phone, username, ...) exists already. mean that account enumeration attacks are possible?
There is an open issue for that, but I think it should already have been solved for registration.

Someone else had a similar problem: #605 (comment) . Maybe that can help you out a bit.

[vinckr]

Hey @marcinkoziej
Just checking in if your question was answered or if there was still something unclear.
If not, could you select the right answer please?

Thanks a ton!

[Serhii-the-Dev]

I have the same issue, if traits.email corresponds to an email returned by OIDC provider, Kratos returns 4000007 on both login and registration flows. Do we have an issue that covers this exact case?

[aeneasr]

This means that the email is already signed up. If it is, you need to link your account instead: https://www.ory.sh/kratos/docs/self-service/flows/user-settings#link-and-unlink-from-google-facebook-github--openid-connect--oauth-20

[EiffelFly]

Sure!! I am willing to help, could you shed light on where to start?

[aeneasr]

I think we need to check the error around here:

kratos/selfservice/strategy/oidc/strategy_registration.go

Line 259 in 648a7bb

return nil, s.handleError(w, r, a, provider.Config().ID, i.Traits, err)

The error is coming from here:

kratos/selfservice/flow/registration/hook.go

Lines 121 to 126 in 77677f6

	} else if err := e.d.IdentityManager().Create(r.Context(), i); err != nil {
	if errors.Is(err, sqlcon.ErrUniqueViolation) {
	return schema.NewDuplicateCredentialsError()
	}
	return err
	}

So we should probably check for that error there and then return a different error message. This would also definitely need some tests!

[EiffelFly]

So what you suggest is show different message, then activate some interior procedure to make the user-agent know what they can do next? But I believe this interior process is not available too?

[aeneasr]

There's no interior process needed, just show a nice UI message to help the user understand what they need to do :)

[EiffelFly]

Got it!! I will try to implement it. Thanks for shedding the light