Home/ Questions/Q 6332841
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-24T18:21:25+00:00

I’ve used Devise as a standard authentication gem for other projects. In another project,

  • 0

I’ve used Devise as a standard authentication gem for other projects. In another project, I’ve used Devise + Omniauth for Twitter authentication.

In a new project I need my end users to be able to login via Twitter and Facebook or to be able to register via the app. In the future the user could link his accounts together. For example, his Twitter and Facebook account. Or, his Twitter and “native” account. “Native” being the account he registered with directly with the web app.

Is Devise capable of such? If so, how do we link the accounts of users together? What is the concept behind this? How does the app know which Facebook and Twitter account belong to which user?

Ideas and suggestions welcome.

EDIT:

I’ve been following http://railscasts.com/episodes/236-omniauth-part-2?autoplay=true and what i dont get is. If

  1. user is signed out of app,
  2. user has an account registered with app,
  3. user signs in with a different service provider (facebook, twitter,
    etc).

How does the app know how to link his new service provider with his already existing accounts?

Stackoverflow.com has this feature. But one service provider they are not including in their “multi-sign” on feature is Twitter. I’m guessing it’s because Twitter doesn’t expose the user’s email through their API. While the other service providers (Facebook, Yahoo, Gmail) does.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Email is generally used to link all the accounts, but with Twitter, you can’t get the email account.
    Using the email is not really a good practice, because the user did not necessarily register to each service with the same email address.

    Asking the user if he wants to use facebook/twitter/google/openid for authentication once he’s logged in is the easiest way, and the more predictable for the user. You must prevent the effect “how does this website know my facebook account? Why are they tracking me?”

    As a side note, the hardest part is not adding a new authentication method, but merging the accounts if the user, as an example, created one account with facebook, and one with twitter.

    • 0