# Discourse doesn't re-verify an address changed by SSO

**URL:** https://meta.discourse.org/t/discourse-doesnt-re-verify-an-address-changed-by-sso/30887
**Category:** Bug
**Tags:** sso, discourseconnect
**Created:** [08.Июль.2015 09:52:08 UTC](https://meta.discourse.org/t/discourse-doesnt-re-verify-an-address-changed-by-sso/30887 "2015-07-08T09:52:08Z")
**Posts on this page:** 1
**Showing post:** 17

<div class="post-metadata">

### Author: ![sascha](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sascha/32/71383_2.png) [@sascha](https://meta.discourse.org/u/sascha)
#### Post date: [28.Апрель.2017 02:58:31 UTC](https://meta.discourse.org/t/discourse-doesnt-re-verify-an-address-changed-by-sso/30887/17 "2017-04-28T02:58:31Z")

</div>

> [@Setup DiscourseConnect - Official Single-Sign-On for Discourse (sso)](https://meta.discourse.org/t/setup-discourseconnect-official-single-sign-on-for-discourse-sso/13045/1):
>
> Discourse will validate that the nonce is valid, and if valid, it will expire it right away so it can not be used again. Then, it will attempt to:
> 
> 1. Log the user on by looking up an already associated external\_id in the SingleSignOnRecord model
> 2. Log the user on by using the email provided (updating external\_id)

If Discourse updates the external\_id of a user based on their email address, isn’t that violating the requirement itself that external\_id will never change? It’s effectively merging two separate external users into one discourse user if their email address is the same.

---

_[View the full topic](https://meta.discourse.org/t/discourse-doesnt-re-verify-an-address-changed-by-sso/30887)._