{"action":"closed","issue":{"url":"https://api.github.com/repos/strongloop/loopback-component-passport/issues/226","repository_url":"https://api.github.com/repos/strongloop/loopback-component-passport","labels_url":"https://api.github.com/repos/strongloop/loopback-component-passport/issues/226/labels{/name}","comments_url":"https://api.github.com/repos/strongloop/loopback-component-passport/issues/226/comments","events_url":"https://api.github.com/repos/strongloop/loopback-component-passport/issues/226/events","html_url":"https://github.com/strongloop/loopback-component-passport/issues/226","id":248696499,"node_id":"MDU6SXNzdWUyNDg2OTY0OTk=","number":226,"title":"Picking random user identity if profile.id or profile.openId is not set","user":{"login":"timowolf","id":9560410,"node_id":"MDQ6VXNlcjk1NjA0MTA=","avatar_url":"https://avatars2.githubusercontent.com/u/9560410?v=4","gravatar_id":"","url":"https://api.github.com/users/timowolf","html_url":"https://github.com/timowolf","followers_url":"https://api.github.com/users/timowolf/followers","following_url":"https://api.github.com/users/timowolf/following{/other_user}","gists_url":"https://api.github.com/users/timowolf/gists{/gist_id}","starred_url":"https://api.github.com/users/timowolf/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/timowolf/subscriptions","organizations_url":"https://api.github.com/users/timowolf/orgs","repos_url":"https://api.github.com/users/timowolf/repos","events_url":"https://api.github.com/users/timowolf/events{/privacy}","received_events_url":"https://api.github.com/users/timowolf/received_events","type":"User","site_admin":false},"labels":[{"id":674905431,"node_id":"MDU6TGFiZWw2NzQ5MDU0MzE=","url":"https://api.github.com/repos/strongloop/loopback-component-passport/labels/stale","name":"stale","color":"ffffff","default":false}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":10,"created_at":"2017-08-08T12:20:37Z","updated_at":"2018-06-01T10:30:52Z","closed_at":"2018-06-01T10:30:52Z","author_association":"NONE","body":"<!--\r\nQuestions:\r\n  https://groups.google.com/forum/#!forum/loopbackjs\r\n  https://gitter.im/strongloop/loopback\r\nImmediate support:\r\n  https://strongloop.com/api-connect-faqs/\r\n  https://strongloop.com/node-js/subscription-plans/\r\n-->\r\n\r\n# Description/Steps to reproduce\r\nWhen using a provider that sends profile information with missing id or open id attribute, while having already some UserIdentities in the database, a random and often wrong user identity is returned by the `findOne()` query. Thus, you login as a different user.\r\n\r\nLine 106 in user-identity.js\r\n```\r\n    profile.id = profile.id || profile.openid;\r\n    userIdentityModel.findOne({where: {\r\n      provider: provider,\r\n      externalId: profile.id,\r\n    }}, function(err, identity) {\r\n```\r\n\r\nIf profile.id is undefined, the query parameter is removed and any existing identity with that provider is returned.\r\n\r\nI would propose to throw an exception if the profile.id is not set. In addition, would be nice to configure which attribute can be used as id from the profile.\r\n\r\n<!--\r\nIf feature: A description of the feature\r\nIf bug: Steps to reproduce + link to sample repo\r\n-->\r\n\r\n# Expected result\r\n\r\nThrow an exception when `profile.id` is not set.\r\n\r\n<!--\r\nAlso include actual results if bug\r\n-->\r\n\r\n\r\n"}}
{"actor":{"display_login":"stale"}}