We’re migrating a Node/Express app from another OIDC identity provider
to Auth0. Sessions are server-side (express-session + Postgres), and our
users table currently keys off the old provider’s OIDC sub.
Our plan is to stop using the IdP subject as our primary key: add
auth_provider / auth_subject columns, freeze our internal user id so
no foreign keys move, and resolve identity on login as
- match (auth_provider, auth_subject) — returning user
- else match on verified email — existing user migrating over
- else create a new user
That handles the large majority of our users cleanly.
The problem is users who originally signed up via Sign in with Apple and
chose “Hide My Email”. Their stored address is a private relay address
that was minted under the old provider’s Apple developer team. Apple
scopes relay addresses per team, so once we configure the Apple social
connection under our own team, the same person arrives with a different
relay address. Step 2 can’t match, and they’d get a new empty account
while their existing one is orphaned.
Two questions:
-
Is there an Auth0-native way to handle this — anything in account
linking, or an Action at polate an Apple
identity whose email has changed? Or is the relay address genuinely
the only signal available autside Auth0? -
For anyone who has migratedom another
provider: did you pre-emptively re-link those users before cutover
(one-time token emailed to handle it some
other way? Interested in what actually worked in practice.