I have a web app which have 2 parts: front part and backend part. Both part need a login page for users. Members need to use /signin to login front part. Admins need to use /admin/signin to login backend part.How to achieve, thank you
It depends what you want to happen when the user logs in via the incorrect /signin page. I'm guessing members should not be allowed in, but what if admin's login to the member's page?
Honestly, the simplest thing is to just hide/show an 'admin' link when an administrator logs in (for example only render the link when a user as an 'admin' role or permission.
Related
Now, I wish to redirect to a private Google group on click of a button on my website along with search parameters. I have generated the required URL using perl. Then I made a simple redirection using . It works when the user is already logged in(using cookies). But it doesn't work if the user has not logged in. I wish to redirect to Google's login page to make sure the user has logged in and thus can access the private group. How do I do this? I read some documentation mentioning OAuth. Is this the only way?
Typically Google handles the login themselfs. A user not logged in will be redirected to their login page first.
You can't use OAuth to log someone into a foreign (aka Google own) service. You could use OAuth to check if a user is logged in at all, but it's not necessary.
The Dancer::Plugin::Auth::Google documentation has a pretty good description on how to setup a Google OAuth login. The Auth::GoogleAuth module might do the job (with less documentation) without using Dancer, but I never tried it myself.
I need to create a login portlet and based on the loggedin user i need to change the result page.Means if the loggedin user is admin then i need to show all the portlets,and if the loggedin user is user then i need to show only the user information.Any one has an idea on this.Providing any samle will be appreciated.Thank You.My required technologies are:liferay6.1,spring,jsp,jquery
You can create a login hook, and handle the redirect after a successful login.
You can start with a hook tutorial
However, you can't manage which portlets are going to be accessible or not, this way. There is a permissions mechanism to do that. You can just use the redirection to prompt them to different pages, hosting the portlets that are accessible to the logged user.
Hello Facebook developpers community,
I'm currently working on a multiplayer online game with HTML/JS.
I just want to allow user to register with the game and I decided to allow them to login with their facebook account. I created a Facebook website application for that.
But when I set a fb:login button on my page, the dialog don't ask me for the permissions I set (FYI : i just configure them in the Authenticated Referrals section).
Maybe I need to configure the permissions in an other place but with the new Auth Dialog, I'm not sure where I need to go..
Authenticated referrals have no effect on usage of fb:login-button, they intended for links to your application on Facebook itself.
To request permissions from user you should use scope parameter of Login Button, here is simple example of requesting email and user_location permissions (both HTML5 and XFBML):
<div class="fb-login-button" data-scope="email,user_location"></div>
<fb:login-button scope="email,user_location"></fb:login-button>
Update:
As stated in comments those attributes may be easily manipulated by "advanced" users to avoid granting permissions. There is no way to specify which permissions will be user will be asked to grant from Application Settings. This isn't really a problem on it's own due to fact that Authenticated referrals suffer from very same problem, once user see authentication step he may change scope parameter to whatever he wants.
Actually you SHOULD NEVER trust to anything that came from user, so you'll better check the granted permissions after he logs-in by querying Graph API:
https://graph.facebook.com/me/permissions
This will return list of permissions user is granted to your app, if something missing react on that.
I am creating a SaaS that will allow users to interact with it via their web applications. I would like to create a CAS type login mimicking Facebook connect so when you click the 'Login' button on the users website it will popup a window for you to login with my SaaS credentials.
I do not want the SaaS users site to be able to access the users login credentials so this is why I thought of CAS. However, it doesn't look like Facebook Connect redirects to the CAS server. It looks like they just popup a window to the facebook login then create a cookie once the user successfully logs into facebook. How then does the Facebook Connected site access that cookie?
I am wanting to basically be able to keep the end user on the current website without being redirected to my login application. I would like to mimic what facebook does with just popping up a little window and have them login then refresh the page after they login but I am not sure how to go about this.
Any ideas?
Facebook uses a third party cookie: they set a cookie on your domain that you can access to get the necessary credentials.
EDIT: the easiest example would be to look at PHP's setcookie function. Notice that there is a domain parameter. If you change the domain to match the domain of the actual website that initiated the authentication action then you'll be able to set a third-party cookie.
Note that on IE there are certain headers the domain that initiated the authentication action needs to set to allow your third-party cookie to be set. See http://www.spamcollect.com/archives/33 for a short writeup of how that works.
If you are working in a different language you'll need to use whatever cookie management functions they offer.
Another option may be to do this with CAS programmatically using the REST client.
https://wiki.jasig.org/display/CASUM/RESTful+API
In this way you could take the users details and login to CAS without being redirected.
Facebook uses Cross Domain communication which is what I will be using.
I have a mysql membership database run by a Perl script. Account creation or login requires an email address and password. The Perl script then sets cookies (password cookie has encrypted value) which allow users to create, own and modify records. A members table contains user information. I've gone through the FacebookConnect information as well as the forum. Maybe I cannot see the forest for the trees, or maybe this is not possible. In order to use FacebookConnect for logins/account creation, I need to be able to send the user email and password to the the Perl script so that the proper cookies are set. If it were an http it would look like this:
http://domain.com/cgi-bin/perlscript.pl?_cgifunction=login&email=ddd#somedomain.com&password=somepassword.
Any hints or advice would be greatly appreciated.
What you are trying to do isn't really possible in the way that you're describing it.
Facebook Connect basically provides you with a single piece of information: whether your visitor is logged in to their Facebook account or not. If they are, you can get their Facebook ID, if not, you can show them a button (or whatever) and ask them to log into Facebook.
Generally a good approach when using Facebook Connect as an authentication method for your site is to have an internal id for the user's member account, and store a user's Facebook ID alongside that. When a user comes to your site, and they are already logged in to Facebook, you just use their Facebook ID to retrieve the local account. Otherwise you show them your login form to log in locally, and/or a Facebook login button.
The problem you're running into here is that you cannot get someone's email address from Facebook, as it is purposely hidden to protect privacy. If your membership scripts provide only the email/password log-in method, then what you need to do is modify these scripts to create the authentication cookie when given a properly authenticated Facebook ID.
Essentially you'll have two login functions... one for a Facebook login, and one for a regular login. Either function should properly created the local authentication cookie.