Ory is the largest open source community in the world for cloud software application security. We maintain advanced open source security software solving authentication, authorization, access control, application network security, and delegation. Ory implements a variety of industry and best-practice standards including OAuth 2.0 / OAuth 2.1, OpenID Connect, Zero Trust Networking, Google Zanzibar Policy Framework, FIDO2 U2F, WebAuthn, TOTP, and more.

Ory Community

Hi team! Is there a reason why an identity cannot be manually linked (via settings flow) with an account from the same OIDC provider? (see <https://github.com/ory/kratos/blob/4415b492a5c7ad0615513bbbfb4f600224e4bf39/selfservice/strategy/oidc/strategy_settings.go#L346-L348|ref>)
I wonder why there’s such limitation while, on the other side, one can link (via Kratos automatic linking flow) an identity with one account from the same provider based on email, for example.
Do you think this behaviour could be configured via Kratos config in the future? I can see a couple of cases where this link makes sense. As an example, why couldn’t I link my google personal identity with my Google work account? I believe it could be a pretty common case

Looking forward to your answer. Thanks in advance :smile:

btw, I built a local version of Kratos commenting out the line I referenced and everything works fine and I couldn’t detect any issues. So I guess there’s nothing else but that check preventing that. That’s why I’m asking about potentially unlocking this limitation :bow: