How to to control which users can use which login methods in Ash authentication

Hi Victor,

here is an idea (not tested): Ash authentication is just an action in the end - e.g. in my app I have both :sign_in_with_magic_link and :register_with_google defined for magic link and Google Authentication, respectively. Can you define an Ash policy that would only allow certain actions to certain users? Or is it more complicated with customer strategies?

Is this the flow?

1. User enters email address
2. The system confirms if he has a bank account.
3. If yes, then use bank auth strategy
4. Else, user password strategy to authenticate.

If that’s the case, then you will need the user to make 2-steps for authentications. Step 1 to help you determine if bank account exists, step 2 to proceed with the desired auth strategy.

A generic action to handle this might be required.

You can put some logic in the action that signs them in and add or return an error in an after_action hook