# Account linking issues

**URL:** <https://community.auth0.com/t/account-linking-issues/115750>\
**Category:** Get Help\
**Tags:** extensibility, actions-extensibility\
**Created:** [September 8, 2023, 9:38am UTC](https://community.auth0.com/t/account-linking-issues/115750 "2023-09-08T09:38:22Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![mhautala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/mhautala/32/33331_2.png) [@mhautala](https://community.auth0.com/u/mhautala)\
**Post date:** [September 8, 2023, 9:38am UTC](https://community.auth0.com/t/account-linking-issues/115750/1 "2023-09-08T09:38:22Z")

</div>

Follow up to this topic: [Account linking](https://community.auth0.com/t/account-linking/92972)

We face the exact same “ **Unable to deserialize user after prompt** ” issue when redirecting from rules/actions and linking an email connection identity to a existing db user.

In the original topic:

> In this situation, we recommend linking the users after the redirection (after the `/continue` endpoint) has completed and using user\_metadata flags to determine if the user satisfies for account linking. This way, the system is able to determine the user\_id.

This fixes the “deserialize” error. However the sub in the access token is the now non-existing user’s. Also there is no session in browser (login page promted) and using the refresh token returns:

```auto
{
  "error": "invalid_grant",
  "error_description": "The refresh_token was generated for a user who doesn't exist anymore."
}

```

The final comments in the original topic:

> Lastly, I found that this is a known issue, and we have an item included in our backlog to address this problem. However, I cannot provide any ETA as to when this item will be fixed.

Is this behaviour going to be changed at some point or is it simply not supported to link users during the authentication flow (unless the primary user is the authenticated one)?

Or in this case you would not want to do it at all. Only way that I can think to get the behaviour we wan’t is to not link to user but simply track in metadata or outside auth0 that these identities are of the same user. In the tokens I can only think a custom “primaryUserId” claim would be needed as otherwise the client applications would treat the user completely different.

---

<div class="post-metadata">

**Author:** ![SaqibHussain](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/saqibhussain/32/42924_2.png) [@SaqibHussain](https://community.auth0.com/u/SaqibHussain)\
**Post date:** [September 24, 2023, 9:42pm UTC](https://community.auth0.com/t/account-linking-issues/115750/2 "2023-09-24T21:42:09Z")

</div>

Hi @mhautala

Thanks for contacting Auth0 Community.

As per my last post on Account Linking via Actions here [https://community.auth0.com/t/linking-passwordless-email-identity-to-primary-identity/97535](https://community.auth0.com/t/linking-passwordless-email-identity-to-primary-identity/97535) this is still unsupported, however, this is being worked on as we speak so support is coming very soon indeed. I expect an announcement will be made here [Auth0 Changelog](https://auth0.com/changelog) when it is ready.

My understanding is that account linking via Rules has a known vulnerability in it, this is why it was removed from our Rule samples. At this moment in time, I would suggest either waiting for the Actions release or implementing your other workaround depending on urgency of your requirements.

Warm regards.

---

<div class="post-metadata">

**Author:** ![mhautala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/mhautala/32/33331_2.png) [@mhautala](https://community.auth0.com/u/mhautala)\
**Post date:** [September 25, 2023, 5:55am UTC](https://community.auth0.com/t/account-linking-issues/115750/3 "2023-09-25T05:55:02Z")

</div>

Thanks for the update. We were able to find out how to get the account linking in Rules to work. The key was this:

```auto
        context.primaryUser = thePrimaryUser.user_id
        return callback(null, thePrimaryUser, context)

```

Where the primary user is the one where the secondary was linked.

What kind of vulnerability there is then? @SaqibHussain

---

<div class="post-metadata">

**Author:** ![SaqibHussain](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/saqibhussain/32/42924_2.png) [@SaqibHussain](https://community.auth0.com/u/SaqibHussain)\
**Post date:** [September 26, 2023, 4:33pm UTC](https://community.auth0.com/t/account-linking-issues/115750/4 "2023-09-26T16:33:37Z")

</div>

Hi @mhautala

We have the issue documented here very briefly [https://auth0.com/docs/manage-users/user-accounts/user-account-linking#precautions](https://auth0.com/docs/manage-users/user-accounts/user-account-linking#precautions) but to provide a bit more context the assumption is made that the user who authenticated as part of login is the legitimate owner of any accounts to be linked. This assumption opens up a potential security flaw as a malicious user could use the same email address to register and create a scenario where that account is now linked to the initial account which may have been via a social connection so one should request authentication for **both** accounts before linking occurs.

Warm regards

---

<div class="post-metadata">

**Author:** ![SaqibHussain](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/saqibhussain/32/42924_2.png) [@SaqibHussain](https://community.auth0.com/u/SaqibHussain)\
**Post date:** [September 26, 2023, 4:35pm UTC](https://community.auth0.com/t/account-linking-issues/115750/5 "2023-09-26T16:35:07Z")

</div>

I would suggest when Account Linking via Actions becomes available to see if you can migrate to it.

---

<div class="post-metadata">

**Author:** ![mhautala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/mhautala/32/33331_2.png) [@mhautala](https://community.auth0.com/u/mhautala)\
**Post date:** [September 27, 2023, 7:12am UTC](https://community.auth0.com/t/account-linking-issues/115750/6 "2023-09-27T07:12:39Z")

</div>

Ok, sounds to me there is no vulnerability in the feature itself but rather that it allows you to shoot in your own foot.

Based to some other Community discussion we might hear about the account linking in actions pretty soon as it should be available before Rules being depricated from **new** tenants.

Maybe the new linking requires to have both the secondary and primary authenticated before allowing the linking (should be doable in Auth0 side - maybe). Interested to see how it turns out…

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [October 11, 2023, 7:13am UTC](https://community.auth0.com/t/account-linking-issues/115750/7 "2023-10-11T07:13:27Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.