# Ability to connect with OAuth providers when user is registered?

**URL:** https://meta.discourse.org/t/ability-to-connect-with-oauth-providers-when-user-is-registered/42457
**Category:** Feature
**Created:** [12 april 2016 om 16:00 UTC](https://meta.discourse.org/t/ability-to-connect-with-oauth-providers-when-user-is-registered/42457 "2016-04-12T16:00:23Z")
**Posts on this page:** 1
**Showing post:** 3

<div class="post-metadata">

### Author: ![fantasticfears](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/fantasticfears/32/119608_2.png) [@fantasticfears](https://meta.discourse.org/u/fantasticfears)
#### Post date: [13 april 2016 om 09:25 UTC](https://meta.discourse.org/t/ability-to-connect-with-oauth-providers-when-user-is-registered/42457/3 "2016-04-13T09:25:22Z")

</div>

> [@sam](#):
>
> That said it is fairly tricky, cause if you allow to “associate” you must also allow to “disassociate”

I think “disassociate” means simply removed associate oauth uid and user\_id in local.

One more problem is that oauth credentials can be expired. The provider may ask for re-authorization. (When a plugin author wants to use the oauth2 credentials to trigger API, they would like to know this situation)

According to those 2 problems, an `Authenticator` has to report association and expiration information. They are simply trying to find a user record implicit.

Now, Discourse has `{google,facebook,github,instagram,twitter}_user_info`. Plugins can use `oauth2_user_info` or `PluginRow`. I would say a new model can represent all those information, for instance:

- `uid`, comes from provider
- `email`
- `name`
- `access_token`
- `refresh_token`
- `expired_at`
- CustomFields or a JSON field, can use for other information storage.

Then a simple query can get a list of associated providers for the user. Disassociation is simply done by remove this record.

Beyond that, `Authenticator` have to provide functions to determine:

- is there a existing user
- is the token fresh

---

_[View the full topic](https://meta.discourse.org/t/ability-to-connect-with-oauth-providers-when-user-is-registered/42457)._