How to handle password login for users who signed up via Google OAuth?

while signing up using google a new account gets created, now when I use a default user/password flow for the same user, how should I distinguish it as a Provider user instead of default password user? I am getting the invalid credentials as the password itself doesn't exist. But casdoor is still checking its password and adding retry count as user email is same. How do we handle such case and prompt a user friendly message.

you said the password is empty?

You want to alert the user like "This user hasn't set a password yet. Click here to reset password to login", like this?

Since user will be using a google sign-in, there is no problem of login but the same email can be used via user/password flow, which shows the error message saying "password or code is incorrect, you have 4 remaining chances". The issue here seems to be lack of distinguishing user as Oauth Provider User or general user/password user in Casdoor. I am not sure if this is a correct approach to take. Will it make sense to auto detect the users email and pop up the respectives third party enable or link for the users?

What will you do finally for distinguishing user as Oauth Provider User or general user/password user in Casdoor?

not so sure, but may be make use a 3rd party logins of user and filter it with the Provider enabled in Application. Do you have any suggestions?

I have created a user via google sign up process, so as expected the user will not have any password set. But I am able to generate a access token using rest API call to "/api/login/oauth/access_token" for the same user without presenting any password. When I check, it is possible because in application . I have Grant Types as Password along with Authorization Code , Refresh Token etc. When I remove the Password from Grant Type, it restrict me saying "grant_type: password is not supported in this application". Is this an expected behavior? Is it possible to restrict this with other approaches ? Should we have an restriction in applications for grant types where password and authorization code couldn't be selected together? Please let me know if I am configuring it in wrong way. @hsluoyz

no password doesn't mean empty string is password

it means password login doesn't work

May be I got you confused a little, I am saying that a google signed in user now can login (generate a token) without using any password but just an email via requesting to "/api/login/oauth/access_token".