Update: Authentication Cheat Sheet - Secure Federated Account Linking

What is missing or needs to be updated?

The Authentication Cheat Sheet covers OpenID Connect, but does not appear to provide guidance for securely linking a federated identity to an existing application account.

OpenID Connect Core states that iss + sub is the stable identifier an RP can rely on, while claims such as email and preferred_username must not be used as unique identifiers.

NIST SP 800-63C-4 also provides specific guidance for account linking, including requiring an authenticated session before linking an additional federated identifier.

How should this be resolved?

Add a short section covering secure federated account linking, including:

• Use iss + sub to identify federated identities.

• Do not treat matching email or other profile attributes as a unique federated identity.

• Authenticate the existing account before linking another federated identity.

• Securely handle removal of linked identities and notify users when identities are added or removed.

References:

• https://openid.net/specs/openid-connect-core-1_0.html

• https://pages.nist.gov/800-63-4/sp800-63c.html

If this makes sense, I'd be happy to work on a PR.