{"action":"created","issue":{"url":"https://api.github.com/repos/pennersr/django-allauth/issues/829","labels_url":"https://api.github.com/repos/pennersr/django-allauth/issues/829/labels{/name}","comments_url":"https://api.github.com/repos/pennersr/django-allauth/issues/829/comments","events_url":"https://api.github.com/repos/pennersr/django-allauth/issues/829/events","html_url":"https://github.com/pennersr/django-allauth/issues/829","id":56922393,"number":829,"title":"Fix for potential problem with AuthProcess.REDIRECT","user":{"login":"arctelix","id":2463347,"avatar_url":"https://avatars.githubusercontent.com/u/2463347?v=3","gravatar_id":"","url":"https://api.github.com/users/arctelix","html_url":"https://github.com/arctelix","followers_url":"https://api.github.com/users/arctelix/followers","following_url":"https://api.github.com/users/arctelix/following{/other_user}","gists_url":"https://api.github.com/users/arctelix/gists{/gist_id}","starred_url":"https://api.github.com/users/arctelix/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/arctelix/subscriptions","organizations_url":"https://api.github.com/users/arctelix/orgs","repos_url":"https://api.github.com/users/arctelix/repos","events_url":"https://api.github.com/users/arctelix/events{/privacy}","received_events_url":"https://api.github.com/users/arctelix/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/pennersr/django-allauth/labels/Design%20Decision%20Needed","name":"Design Decision Needed","color":"207de5"},{"url":"https://api.github.com/repos/pennersr/django-allauth/labels/Feature%20request","name":"Feature request","color":"02d7e1"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-02-07T19:23:09Z","updated_at":"2015-08-07T19:55:51Z","closed_at":null,"body":"I am using the AuthProcess.REDIRECT along with dynamic scope and params for incremental authorization and have come across a potential problem when a user has two separate site accounts connected to two separate provider accounts.  The problem arises in the following  scenario:\r\n\r\n 1. User logs in to site as provider p_userA.\r\n 2. Then User logs into provider as p_userB.\r\n 3. User attempts to add dynamic scope to their `SocialAccount`.\r\n 4. The `SocialAccount` for p_userB is returned by `sociallogin` rather then the request.user's   p_userA `SocialAccount`.\r\n\r\nI am using the flowing solution which i think would be worthwhile to include in allauth's `complete_social_login` or `_social_login_redirect`.  If you agree, i wold be happy to prepare a pull request.  (`get_site_name` can be substituted for \"our site\" but, perhaps this could be useful in other templates)\r\n\r\nGranted, this could be quite confusing to an end user. However, if the end user was savvy enough to have two provider accounts they can figure this out. \r\n\r\nDefaultSocialAccountAdapter.pre_social_login():\r\n\r\n    if process == AuthProcess.REDIRECT:\r\n            account = sociallogin.account\r\n            if not request.user == account.user:\r\n                c_account = SocialAccount.objects.get(user=request.user, provider=account.provider)\r\n                mismatch_p_account = account.get_provider_account()\r\n                context = {'sitename': get_site_name(request),\r\n                                 'provider': account.provider,\r\n                                 'current_p_account': c_account.get_provider_account(),\r\n                                 'mismatch_p_account': mismatch_p_account,\r\n                                 'mismatch_account_url': mismatch_p_account.get_profile_url()}\r\n                resp = render(request, 'socialconnector/account_mismatch.html', context)\r\n                raise ImmediateHttpResponse(resp)\r\n\r\naccount_mismatch.html:\r\n```\r\n{% extends \"account/base.html\" %}\r\n{% load url from future %}\r\n{% load i18n %}\r\n\r\n{% block head_title %}{% trans \"Account Mismatch\" %}{% endblock %}\r\n\r\n{% block content %}\r\n<h1>\r\n    {% trans \"Account Mismatch\" %}\r\n</h1>\r\n\r\n<h2>\r\n    {% blocktrans with provider=provider|capfirst %}\r\n    It appears you are logged into {{ provider }} as a different user.\r\n    {% endblocktrans %}\r\n</h2>\r\n\r\n<p>\r\n    {% blocktrans with provider=provider|capfirst %}\r\n    You are currently logged in to {{ sitename }} as \"{{ current_p_account }}\",\r\n    but you are logged into {{ provider }} as \"{{ mismatch_p_account }}\".\r\n\r\n    Please do one of the folowing to correct the problem:<br>\r\n    1) If you would like to continue using your current {{ provider }} account:<br>\r\n       Choose Logout below then log in as \"{{ mismatch_p_account }}\".<br>\r\n    2) If you would like to continue using your current {{ sitename }} account:\r\n       Choose {{ provider }} below, then logout and log back in as \"{{ current_p_account }}\".\r\n\r\n    {% endblocktrans %}\r\n</p>\r\n<p>\r\n    <a href=\"{% url 'account_logout' %} \" target=\"_blank\"><div class=\"btn btn-primary\">{% trans \"Logout \" %}</div></a>\r\n    <a href=\"{{ mismatch_account_url }}\"><div class=\"btn btn-warning\">{{ provider|capfirst }}</div></a>\r\n</p>\r\n{% endblock %}\r\n```\r\n\r\nhelpers for sitename:\r\n```\r\ntry:\r\n    from django.contrib.sites.models import Site, get_current_site\r\nexcept ImportError:\r\n    get_current_site = False\r\n    Site = False\r\n\r\ndef get_site(request=None):\r\n    if get_current_site and request:\r\n        site = get_current_site(request)\r\n    elif Site:\r\n        site = Site.objects.get_current()\r\n    else:\r\n        class site(object):\r\n            domain = app_settings.SITE_DOMAIN\r\n            name = app_settings.SITE_NAME\r\n    return site\r\n\r\ndef get_site_name(request=None):\r\n    site = get_site(request)\r\n    return site.name\r\n\r\ndef get_base_url(request=None):\r\n    site = get_site(request)\r\n    return 'http://%s' % site.domain\r\n```"},"comment":{"url":"https://api.github.com/repos/pennersr/django-allauth/issues/comments/128815231","html_url":"https://github.com/pennersr/django-allauth/issues/829#issuecomment-128815231","issue_url":"https://api.github.com/repos/pennersr/django-allauth/issues/829","id":128815231,"user":{"login":"arctelix","id":2463347,"avatar_url":"https://avatars.githubusercontent.com/u/2463347?v=3","gravatar_id":"","url":"https://api.github.com/users/arctelix","html_url":"https://github.com/arctelix","followers_url":"https://api.github.com/users/arctelix/followers","following_url":"https://api.github.com/users/arctelix/following{/other_user}","gists_url":"https://api.github.com/users/arctelix/gists{/gist_id}","starred_url":"https://api.github.com/users/arctelix/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/arctelix/subscriptions","organizations_url":"https://api.github.com/users/arctelix/orgs","repos_url":"https://api.github.com/users/arctelix/repos","events_url":"https://api.github.com/users/arctelix/events{/privacy}","received_events_url":"https://api.github.com/users/arctelix/received_events","type":"User","site_admin":false},"created_at":"2015-08-07T19:55:51Z","updated_at":"2015-08-07T19:55:51Z","body":"I stepped away from this project for a bit, but wanted to get back to your comment. I threw this out there originally to make a placeholder for what i thought could be useful authentication logic in the future. \r\n\r\nI disagree that this would make allauth aware of dynamic scopes and I'm not suggesting that allauth should in any way try to implement dynamic scopes for us.  I was thinking more along the lines of authentication and that it should be aware of the possibility that one user can have multiple accounts from the same provider.  \r\n\r\nAlthough this would be triggered by a dynamic scope request, it think it is still technically an authentication issue and would lessen the burden of detecting these errors when implementing dynamic scopes.  Another use case: I think it is inevitable that allauth will eventually allow a user to connect multiple accounts from the same provider (I plan to develop this feature).  \r\n\r\nI'd have to get back into the project to confirm, but i believe request.user.is_anonymous() was redirected to login higher up the logic chain.  Again this would probably be different for each use case."}}