'The login flow executes both with anonymous and authenticated users.
Upon completion a few branches exist:
If the identity is already linked, the user should be logged in
and redirected immediately.
Otherwise, the user is presented with a confirmation window. That window
will show them the new account that will be created, and if they\'re
already authenticated an optional button to associate the identity with
their account.'

@transaction.atomic
def _finish_login_pipeline(self, identity):

    auth_provider = self.auth_provider
    lock = locks.get('sso:auth:{}:{}'.format(auth_provider.id, md5_text(identity['id']).hexdigest()), duration=5)
    with TimedRetryPolicy(5)(lock.acquire):
        try:
            auth_identity = AuthIdentity.objects.select_related('user').get(auth_provider=auth_provider, ident=identity['id'])
        except AuthIdentity.DoesNotExist:
            return self._handle_unknown_identity(identity)
        if (not auth_identity.user.is_active):
            if (not self.request.user.is_authenticated()):
                return self._handle_unknown_identity(identity)
            auth_identity = self._handle_attach_identity(identity)
        return self._handle_existing_identity(auth_identity, identity)
