User Modeling with Oauth 2

Question

I am building a web application using rails 3. I have my own user registration, login and authentication, which work fine, and I want to add an Oauth 2 implementation so that people can connect to Facebook and login / registration in less steps.

I have started this work successfully. So far, I can get facebook to authenticate users and give me permission to access their information. I haven't tried setting up Twitter authentication yet, but I assume it will work the same way.

Now I'm thinking about how to integrate this into an existing user model, which basically consists of a table of users who have emails, names and passwords.

Should I leave my users table as it is and set up the access providers table:

id | user_id | provider_id | access_key --------------------------------------- 1 | 4 | 1 | xyz 2 | 4 | 2 | pqr 3 | 7 | 1 | dfr 

and allows you to scan the table "Facebook User Information", in which I store information about the user who was obtained from access to this user on the facebook graph?

Thus, I can save the Users table with a normalized database of information that each user has, regardless of whether they are connected via facebook or not (name, email address, password) and supplement this data with data from their facebook profile if it becomes available

Is there a better way to do this? Is there a good guide or tutorial for developing this type of database model (think Quora)? I can also handle the PHP tutorial.

Sorry for the open question.

Answer 1

You might want to consider Signet or OmniAuth for your OAuth client if you are trying to do both Twitter and Facebook. I tend to Signet as I wrote it, but OmniAuth might be the best choice at the moment, as it was a little longer, depending on what you are trying to do.

Regarding data modeling, you have the right idea. You should probably make it a little more general. Instead of access_key you probably need access_token and possibly refresh_token for OAuth 2. Meanwhile, OAuth 1 uses a key / secret pair. So there might be something like this (omitting primary and foreign keys):

 auth_scheme | access_token | refresh_token | key | secret | username | password ------------------------------------------------------------------------------- oauth_1 | | | 123 | 456 | | oauth_2 | 123 | | | | | oauth_2 | 123 | abcd | | | | xauth | | | | | abcd | 12345 clientlogin | | | | | abcd | 12345