Integrate Facebook single sign-on into an existing user / password login scheme

Question

I use Facebook authentication to prove that my client software (native iOS) acts on behalf of a specific FB user. But how can my client prove this on my server, which has its own login scheme. I think he needs to pass the FB access_token to my server, so my server can ask Facebook to get the user ID?

Or is there a way to get Facebook to store my own access credentials (username + password for my existing registration system)? So, after logging in to Facebook, my client will retrieve his username and password from Facebook and use it to log in to my system?

Answer 1

OK, here is my pragmatic solution to the same problem.

You authenticate iOSApp with facebook . This gives you access_token and you can get the facebook user id ( fb_id ) from facebook .

Now you want to use this authentication to authenticate the request for some service related to iOSApp (yourService).

Send fb_id and access_token with a reliable request to your service (for example, using https).

yourService then uses fb_id and access_token to make an arbitrary call to the social graph, for example:

https://graph.facebook.com/ fb_id ? field = name & access_token = access_token

This call will return a corresponding error if the access_token is invalid or does not match fb_id , so yourService can now execute or reject the request based on the return value.

yourService and iOSApp can read or change the FB schedule in accordance with the permissions and access_token status, but above all this you need if you just want to authenticate the user using your service when they have already authenticated using iOSApp.

There may be some problems with the FB policy regarding access_token transfer, but as long as you use https for transfer, it is as secure as the exchange between iOSApp and Facebook.

Answer 2

What I did in the end was that my server sent the client a random password to log in through a request to the Facebook application. Ie, the iOS client sends fb_id to my server, my server generates a random password and publishes it as a Facebook app_request application. The client retrieves app_request from Facebook and uses the password for authentication on my server.