force-unique-email-across-social-identities does not seem to work how it is intended

[luismendiola98]

trafficstars

I was testing the force-unique-email-across-social-identities policy, but I was able to sign in with my google and twitter account (which both use the same email address) with out getting the error message that an account with the same email address is already registered. Am I missing something? Thank you for your assistance in advance.

[JasSuri]

Did you uncomment this step?

https://github.com/azure-ad-b2c/samples/blob/5c3dfeeff3c2cf105e1f4505b193a582a1b1abe2/policies/force-unique-email-across-social-identities/policy/TrustFrameworkExtensions.xml#L260

[luismendiola98]

I did and I got the same error as the person that created this issue. I see that you were able to point them in the right direction. It looks like they changed "strongAuthenticationEmailAddress" to "signInNames.emailAddress". I made this change, but I still did not get the error message expected for accounts with same email address. Is there more I need to add/edit to the files provided in this sample to make it work?

[JasSuri]

The sample is assuming that the social email/identifier is stored in strongAuthenticationEmailAddress.

By default, the email of social accounts aren't stored on the user at all, so nothing you change the above to would work, until you start to store the users social email first. Then whatever attribute you choose to store it in, is the attribute you should check for uniqueness.

changed "strongAuthenticationEmailAddress" to "signInNames.emailAddress". I made this change, but I still did not get the error message expected for accounts with same email address.

That would only work if when a social user is created, their email is stored in signInNames.emailAddress. AAD-UserWriteUsingAlternativeSecurityId creates the users profile for social account sign up. You need to map the users email claim from the Social IdP technical profile, then persist that to a uniquely constrained attribute (eg signInNames or strongAuthenticationEmailAddress) attribute using AAD-UserWriteUsingAlternativeSecurityId.

[luismendiola98]

Thank you for explaining how to make this sample work. I will go over the documentation once more to better understand the structure of the policy files so that I can make the necessary changes at the right places. I will let you know how it goes as soon as I make the changes.