# Linking SAML account and want to require user to enter password before linking

**URL:** <https://community.auth0.com/t/linking-saml-account-and-want-to-require-user-to-enter-password-before-linking/188947>\
**Category:** Get Help\
**Tags:** protocols, saml\
**Created:** [July 9, 2025, 7:06am UTC](https://community.auth0.com/t/linking-saml-account-and-want-to-require-user-to-enter-password-before-linking/188947 "2025-07-09T07:06:19Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![jeremybong](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jeremybong/32/70899_2.png) [@jeremybong](https://community.auth0.com/u/jeremybong)\
**Post date:** [July 9, 2025, 7:06am UTC](https://community.auth0.com/t/linking-saml-account-and-want-to-require-user-to-enter-password-before-linking/188947/1 "2025-07-09T07:06:19Z")

</div>

Hello! My team is in the process of migrating to Auth0 and SSO, and I have a question regarding converting previous non-SSO users to SSO users.

Here’s our scenario: all our current users are non-SSO users and use their email address as their login ID. Our goal is to convert them to SSO users with the next release and allow them to sign-in using their IDPs, which we will register in our Auth0 account.

From my understanding and experiments using an internal test IDP, when an existing user signs in after we’ve registered their IDP, a second samlp account will be created, and this account is separate from their original account.

We can link their new samlp account to their auth0 account that existed before we configured their IDP connection using the linkAccounts API in the management API. This is fine and good, but we also want to have the users enter their password to their original pre-IDP account before we link the accounts for obvious security purposes. How can this be done? I have been trying to get this to work as a post-login action but what happens is the user just keeps going in loops between the IDP and the universal login screen.

I would like to know if this flow sounds correct, and if yes then how it can be achieved. Thanks!

---

<div class="post-metadata">

**Author:** ![teodor.andrei](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/teodor.andrei/32/75320_2.png) [@teodor.andrei](https://community.auth0.com/u/teodor.andrei)\
**Post date:** [July 9, 2025, 12:33pm UTC](https://community.auth0.com/t/linking-saml-account-and-want-to-require-user-to-enter-password-before-linking/188947/2 "2025-07-09T12:33:59Z")

</div>

Hi @jeremybong, and thank you for the question!

I believe your flow using a post-login action is correct, and all you need is to add a check that exits the flow if the users have already been linked to prevent the loop you are experiencing.

You can try to do that using the [event.user.identities](https://auth0.com/docs/customize/actions/explore-triggers/signup-and-login-triggers/login-trigger/post-login-event-object#:~:text=original%20authentication%20request.-,event.user,-An%20object%20describing) array like this:

```auto
const primaryIdentity = event.user.identities[0];
const secondaryIdentity = event.user.identities[1];

if (!secondaryIdentity) {
    return;
}

```

I hope this helps you!

Sincerely,  
Teodor.

---

<div class="post-metadata">

**Author:** ![jeremybong](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jeremybong/32/70899_2.png) [@jeremybong](https://community.auth0.com/u/jeremybong)\
**Post date:** [July 9, 2025, 4:15pm UTC](https://community.auth0.com/t/linking-saml-account-and-want-to-require-user-to-enter-password-before-linking/188947/3 "2025-07-09T16:15:17Z")

</div>

Hi Teodor, thank you for responding. The problem is this infinite loop doesn’t even let the code get to the account linking part, so this will not be reached. They go from entering their email address (where we also have Home Realm Discovery turned on so we can detect when to send them to their IDP to sign in), to getting sent back to the universal login page, and then get sent back to the IDP sign in.

Here’s more context: As I mentioned above, before linking accounts, I would like to have the user reenter their old account credentials. The following line is the last line called in `exports.onExecutePostLogin`, and `appDomain` is set to our universal login page:

```auto
api.redirect.sendUserTo(event.secrets.appDomain, {
      query: {
        session_token: sessionToken
      }
    });

```

---

<div class="post-metadata">

**Author:** ![teodor.andrei](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/teodor.andrei/32/75320_2.png) [@teodor.andrei](https://community.auth0.com/u/teodor.andrei)\
**Post date:** [July 15, 2025, 11:51am UTC](https://community.auth0.com/t/linking-saml-account-and-want-to-require-user-to-enter-password-before-linking/188947/4 "2025-07-15T11:51:33Z")

</div>

Hi @jeremybong, thank you for adding more context.

I did some digging, and the problem seems to be that the `api.redirect.sendUserTo()` method is not meant for this use case, and it’s what causes the infinite loop.

I couldn’t find a feature specifically designed for your use case, but there are a couple of things I think you could try:

1. Forcing a user to authenticate, as described by my colleague Rueben in this community [topic](https://community.auth0.com/t/how-do-i-force-a-user-to-login-again/107572/2).

2. Use the **Resource Owner Password Grant** flow to verify the current password as described in this [Knowledge Article](https://community.auth0.com/t/verify-current-password-before-changing-to-new-one/117705) for a similar topic, verifying the current password before changing to a new password.

I hope this helps you!

Kind regards,  
Teodor.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [July 29, 2025, 11:52am UTC](https://community.auth0.com/t/linking-saml-account-and-want-to-require-user-to-enter-password-before-linking/188947/5 "2025-07-29T11:52:15Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.