A great bug on JFBConnect

Aitor,
The issue with username uniqueness doesn't affect just JFBConnect. There was a bug in Joomla where in specific cases the username could be duplicated. We have multiple checks within JFBConnect to prevent creating them and also relied on some checks that Joomla has built in, but it seems those didn't always work.

We updated this site and found 27 duplicate usernames (out of >50,000 accounts). The last duplicate username was from 2014, so it's an issue that's progressively been going away with new safeguards implemented in JFBConnect and Joomla. JFBConnect and Joomla are our only means of registration.

With that said, can you explain how you know 'all' of the duplicate accounts were caused by JFBConnect? On our site and others with JFBConnect, we aren't seeing thousands of duplicates. You also mention JomSocial. I'd like to understand how you've narrowed down all duplicate usernames to JFBConnect. I wasn't able to understand your explanation:

i saw that JFBConnect use only the user with the first id to access from all facebook profiles,

Can you help explain this more?

Finally, Joomla has already an FAQ related to this issue:
docs.joomla.org/J3.x:Duplicate_usernames_cause_update_issue

The original issue tracker post is:
github.com/joomla/joomla-cms/issues/28308

Again, it is possible JFBConnect has created duplicate usernames. We'd like to understand your situation more so we can investigate the issue more thoroughly.

Thanks,
Alex

As a followup, if you have registration dates for the duplicates, that would be helpful. Mainly, have duplicates been created recently or did they stop being created years ago as we've seen?

Thanks,
Alex

We completely agree that duplicate users can cause problems. I'd like to understand why you feel JFBConnect is the cause of all of your duplicate users as you originally posted. Any details on your investigation will help us understand the issue further and if there's anything we can do better within our code.

Thanks,
Alex

We'll have to investigate how the blank password option could cause what you're describing. Can you tell me also if the duplicate accounts have the same (or very close) registration dates? That will help us understand if they were created at the same time or if one was created and another was created much later.

We are still unable to see a cause in our code that would allow duplicates, but again, were also relying on some safeguards within Joomla. Fortunately, the newest Joomla release adds a unique index to the username column, which prevents duplicates completely. We still want to make whatever changes are necessary to prevent the issue in case things change in the future.

Thanks,
Alex