Will user_id's change for existing FB social id provider users if the Connection App Id changes?

Help
, ,
1

I’m trying to switch from one Facebook App (i.e., the entities that appear in the “Admin Apps” section of https://developers.facebook.com/) to a new one for the facebook Social Connection. (Why? Because Facebook disabled the old one and won’t respond to our appeals).

I’ve successfully configured the new app, set it to “Live” status in the Facebook Developer portal, and updated the App Id and App Secret in the auth0 management interface. I’m able to successfully sign up as a new user with the updated connection. But I’m having trouble with our pre-existing users.

When they attempt to authenticate, it appears that they’re being assigned new user_id’s, with the same email addresses as their pre-existing profiles in auth0.

In other words, we wind up with, for the same user, with the same email address, two auth0 profiles, both prefixed with facebook| in their user_ids. Not good! We have some logic in our app that detects this case (to deal with the situation where they’re trying to make a new account using an email address that already ha a profile), and stops them from proceeding. So the result is, they can no longer log in with Facebook at all.

Is this behavior expected (that a new app Id and secret would yield new/different user_id’s), and any advice on how to deal with it?

1 Like
2

Hi @scott2 ,

Thanks for posting in Auth0 Community!

Your description makes sense since creating two separate Facebook connections will create duplicate users - same user logging in through the second connection will create another user record on Auth0 side. In general, it should be ok to run two connections in parallel for some time as long as you can define clearly which connection when to use.

Is your goal to keep using both connections? Keep in mind that users don’t really “sign-up” with a social connection, they’re just doing a login:

  1. The user enters your application and selects the desired social network provider.
  2. A login request is send to the social network provider.
  3. Once the social network provider confirms the user’s identity, a current user will get access to your application. A new user will be registered as a new user and then logged into the application.
1 Like
3

Hi @lily.wisecarver, thanks for the reply — I do understand that the behavior we were seeing is expected. In the end we were able to get Facebook to reactivate the app they had disabled, so the issue became moot.