# Validate and Block Social Login If User Email Address already exists and not verified

**URL:** <https://community.auth0.com/t/validate-and-block-social-login-if-user-email-address-already-exists-and-not-verified/96324>\
**Category:** Get Help\
**Tags:** auth0-authorization, extensions\
**Created:** [December 13, 2022, 6:49am UTC](https://community.auth0.com/t/validate-and-block-social-login-if-user-email-address-already-exists-and-not-verified/96324 "2022-12-13T06:49:06Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![dayocodes](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dayocodes/32/41905_2.png) [@dayocodes](https://community.auth0.com/u/dayocodes)\
**Post date:** [December 13, 2022, 6:49am UTC](https://community.auth0.com/t/validate-and-block-social-login-if-user-email-address-already-exists-and-not-verified/96324/1 "2022-12-13T06:49:06Z")

</div>

Users can register and login on our platform directly with email address or via sso login . We need to deny SSO login for a user if the email address already exists and not verified in auth0 (No account linkage) using Actions. I have read through the proposition from [this](https://community.auth0.com/t/validation-before-registration-of-social-account-in-auth0/84729/7) but want to know if there exists a better flow.

---

<div class="post-metadata">

**Author:** ![david\_wisecarver](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/david_wisecarver/32/37472_2.png) [@david\_wisecarver](https://community.auth0.com/u/david_wisecarver)\
**Post date:** [December 16, 2022, 11:04pm UTC](https://community.auth0.com/t/validate-and-block-social-login-if-user-email-address-already-exists-and-not-verified/96324/3 "2022-12-16T23:04:22Z")

</div>

Hi @dayocodes,

Welcome to Auth0 Community!

You should be able to accomplish this use case using Actions. For social connections, the pre-registration and post-registration Actions do not run, so you would need to use the [post-login Action](https://auth0.com/docs/customize/actions/flows-and-triggers/login-flow), and you would want to make sure it is the user’s first time logging in by using `event.stats.logins_count === 1`.

From there you can do a [user search](https://auth0.github.io/node-auth0/ManagementClient.html#getUsers) for the same email and if `email_verified` is false, and if so you can then deny access and [delete the account](https://auth0.github.io/node-auth0/UsersManager.html#delete).

Here is an example of what the Action could look like:

```auto
exports.onExecutePostLogin = async (event, api) => {
  if(event.stats.logins_count != 1){return;}
  
  const ManagementClient = require('auth0').ManagementClient;
  const management = new ManagementClient({
    domain: event.secrets.domain,
    clientId: event.secrets.clientId,
    clientSecret: event.secrets.clientSecret,
  });

  const params = {
    search_engine: 'v3',
    q: `email:"${event.user.email}" AND email_verified:false`
  };

  try {
    const users = await management.getUsers(params);
    if (users.length > 0) {
      management.users.delete({ id: event.user.user_id });
      api.access.deny('duplicate_email', 'You already have an account with a Database Connection, and the email is not verified yet');
    }
  } catch (e) {
    console.log(e)
    // Handle error
  }
  
};

```

Hope this helps!

Thanks,  
Dave

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [December 30, 2022, 11:04pm UTC](https://community.auth0.com/t/validate-and-block-social-login-if-user-email-address-already-exists-and-not-verified/96324/4 "2022-12-30T23:04:43Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.