Discourse doesn't re-verify an address changed by SSO

[sascha (Sascha Hlusiak)]

@sam

Discourse will validate that the nonce is valid, and if valid, it will expire it right away so it can not be used again. Then, it will attempt to:

1. Log the user on by looking up an already associated external_id in the SingleSignOnRecord model
2. Log the user on by using the email provided (updating external_id)

If Discourse updates the external_id of a user based on their email address, isn’t that violating the requirement itself that external_id will never change? It’s effectively merging two separate external users into one discourse user if their email address is the same.