Is it possible to replace the returned id_token in Auth0 rule

You should avoid that scenario through rules because linking a user identity means that the secondary user identity is removed from the system in terms of it being a standalone account. When a user authenticates through Google and you automatically provision a database user and link both while treating the Google identity as secondary in practice the user that is currently in the middle of an authentication process is removed and this will likely lead to issues.

If you want to automatically provision database users and use them as the primary identity for linked accounts you should do the linking process after the user authentication process (based on a social provider) completes. For example, the client application would receive a Google identity detect there’s no associated username/password identity and trigger the automatic provision and linking of the database user as the primary. However, this implies that your client application will receive an ID token associated with a social user the first time they login.

1 Like