In our organization we have a website that stores all our clients data. until recently this was hidden behind a htaccess file. This setup was primitive and I'm in the process of making it better.
My idea is that I want to have an account for everyone in the organization but I don't want them to register with a new username and password and just let them login using their facebook account.
So I was wondering if it would be possible to use the facebook login button but only let a certain list of people login? And if possible maybe some guidelines on how to do it?
Thanks in advance!
Related
I have a web app that has its own user registration, with a handful of users. The only mandatory fields are email, password and username, which must be unique. In the long run, I will still want to have our own registration system.
I would like to integrate Facebook, but I'm trying to figure out if I should integrate Facebook Registration or Facebook Login. I have these questions:
I've already started integrating Facebook Login and it works well. With this, not only can I enable Facebook users to login, but I can get all the information I need to register the user, if he is signing in for the first time via Facebook and has not registered via our site yet. I do not prompt the user for a password, to simplify the registration, however this means that if the user tries to sign in directly into our site, I tell the user that he must sign in via Facebook Login. Therefore, I question the need for Facebook Registration, which seems to be more complicated to integrate than Facebook Login. Can anyone tell me why I should integrate Facebook Registration instead?
The drawback I see with integrating Facebook Login or Facebook Registration into our existing user registration, is the username. I currently copy the user's Facebook username into our database. However, there is the possibility that the user's Facebook username is missing or is a duplicate of an username from one of our existing users, in which case I will have to prompt the user to change it. Then what happens if in the future, the user changes his username on Facebook? Should I change the user's username on our site when he logs in next via Facebook? What is best practices here? Am I correct to assume that if I don't bother changing the user's username on our site, it won't be an issue?
Then there is the possibility that the user's Facebook username is not valid by our requirements. Currently, we require the username to be alphanumeric and underscores only, using this reg expression: /^[\w]*$/ However, Facebook allows periods, but not consecutive special characters and possibly other criteria that I did not detect. This means that I should use the same validity check as Facebook uses. Does anyone know Facebook's reg expression for their usernames?
I am able to show the Facebook user's profile photo with an IMG tag and src= http://graph.facebook.com/facebook.id/picture. Does anyone know how to save the photo onto our server? We use Javascript and PHP.
Thanks for your help!
Hey I'll try to address your points 1 by 1
Facebook Login is merely a means to sign a user in to your site by them connecting via Facebook, as you state, they don't have a password as Facebook handles the auth. However you could redirect them to a specific page after using facebook login and get them to enter a password to use their account without being connected to facebook. The facebook registration plugin is more a tool to get users to register on your registration system (although it does support being your only registration system). It provides convenience by pre-populating a number of fields you might commonly ask for such as name etc. if a user is already logged in to Facebook. You can customise though to ask for additional info. It also means you can supply 1 registration form for your users whether or not they use facebook.
The facebook username should not be missing. Their 'name' field should be the users first and last name which I believe they have to supply. I don't think it can be empty. What I would actually suggest doing, is what I mentioned in point 1. Allow users to connect via facebook, but then prompt them to enter a username either as part of the login flow or after. You can then check this for uniqueness against your current database. To begin with you could assign them a username that is first_last_timestamp or something similar. This would more likely encourage them to change their username to something they want. If you used the registration plugin, you could easily enter your own "username" field into this. Then it doesn't matter if the user changes their name on facebook as they would still have a unique username to your site.
Facebook's usernames should just be a users first and last name (though obviously people do enter random things). The 'name' field is an combination of these so there will most likely be a space between them. You could always replace any invalid characters using your own regex, replace whitespace with underscores etc.
I'm not sure if there are any platform policies that would restrict you from saving the users picture to your own server/DB. What I would ask though is why you would want to? In my experience this is more likely to change then their name is. As such groups of friends using your site are probably more likely to recognise the profile pic that their friends use on facebook.
I would finally say, that the best bit about connecting their Facebook account either way means you can provide a smooth login experience so that a user doesn't have to sign in everytime. My own personal experience is that facebook login (with your own integration code on the success page) is better than the registration plugin. There are fewer steps for a user to connect to your app this way and they don't have to fill out a form. The success callback also means you can still perform the custom username code/flow I mentioned above and then prompt them to change their username if they desire. Just remember it is best to ask for as little info as possible at sign-up as users are more likely to join this way.
Hope this helps!
I am new to web development. My goal is:
- I have username and password for a facebook (FB) user.
- Now, I want to pass these credentials(via POST,GET or any other way...whatever) to FB to validate the user and if validated, save the user session.
- I read articles on oAuth and understood the idea. However, in that you need to create an APP on FB first and then you can use the APP Id and validate FB user. I do not want to create any APP on FB. I have a username and password and just want to pass it to FB some how and validate the user.
Let me know if this is possible? I work on C#.net/VS2008. However, if it is not possible in .net then please advise if it is possible in any other language/technology.
Thanks and regards,
AG
A user is not allowed per the policy to share its username and password, so what you are proposing is therefor also not allowed, and hence not made possible.
I'm trying to implement facebook connect to my website, and i have couple questions.
1: Is it possible to register user in my website using his current facebook email/password.
Let's say user clicks on link Register via facebook and then he have to give me permisions to access his password, email, etc... and after that is done i put that info in my own database and he will be able to login with that account any time he wants without needing to give me permisions any time in the future.
2: If that kind of registration is not possible, what's other solution would be the best for me? Because i need to somehow keep track of that user who logged in with facebook, because he can upload photos, send messages etc.
Anyways, i'm quite new with facebook and similar things, so i'm really lost here, hope some one can help me :)
EDIT Thank you all for wonderful answers it helped me a lot, now all that's left is to read documentation :)
Yes it is, it is possible to get the information of the user. But it is rather complicated, when you have never dealt with it.
First you need to send the user to the following link:
https://m.facebook.com/dialog/oauth?client_id=your-client-id&redirect_uri=xxx&scope=listof-information-you-want
Facebook will then return your client to the uri specified, if the user rejected it will give a reason. If it is not you will get an code in urlencoded format.
This code is needed for the following step, the request of the access token:
https://graph.facebook.com/oauth/access_token?redirect_uri=xxx&client_id=xxx&client_secret=xxx&code=xxxx
This will give back an access token, if the authorization didn't fail.
After that you can ask for the information you want:
https://graph.facebook.com/me?method=GET&metadata=true&format=json&access_token=access_token
This will include a facebook uid, which is unique for all users. Store it and you can discern between a register and login.
This is roughly the process for any oauth2 application.
Facebook will not ask repeatedly for permissions after the user granted them to you. So you can store the access token and reuse it for backend stuff and also use the same procedure you use for register for login.
You can never access the user's password from Facebook even with his/her permission, so the user will always have to authenticate via Facebook and have Facebook pass you the user id of the logged in user once authentication succeeds. You can store all kinds of other data locally, but not enough to authenticate the user yourself.
Once the user is authenticated, you'll have access to the user's Facebook user id via the API, which should be enough to connect all kinds of information to that specific user.
Facebook does not provide access to accounts when passwords are taken from your controls. It provides it own canvas for login information. Therefore you cannot use your first approach to store passwords in your databases. Check this out.
You can however store email addresses once user logins into his account using the facebook sdks. Check this out link for the example of C# SDK sample code.
You can use the Facebook APIs to fetch user email-id, photos, friendslist and other information and then play around accordingly.
You don't get access to the users password - only email if you ask for it.
Best way would be to have a table of users and their Facebook account id's.
If you want to allow users to sign up without Facebook then have a nullable field for their password and facebook id, and also have a field for username - which you could populate from Facebook if they register via that route.
I'm developing a website where the user can either sign up creating his own profile or can sign in with FB or Twitter.
The thing is I don't really know how to manage it, for example: let's say my user signs up through the website and creates content, what happens if the user later decides to sign in with FB or Twitter? How can I keep it all unified?
I know I could just do the Twitter sign in, get the data from twitter and create a profile in my DB for the user with his Twitter handle, don't know how I'd deal with later if he wants to just log in through the site.
Anyone have any ideas?
So he later signs in with Twitter or Facebook. I think you have a couple of options in this case. Allow the ability to link accounts together once the user signs in with any one method. Say they sign in with your sites registration, let them hit a page where they can add in other linked accounts like Twitter and Facebook once they are in their logged in state on your site. See the friendfeed model for inspiration. Or, like we did with ucubd.com/index.aspx - let the user sign in with facebook and regsister an account on their behalf and ask for their email as the login credential. If it's found - great. If it's not ask for a password. This will allow the user to either login with your sites registration method or through facebook. You will have the information in your database to link both of them together.
Every account on your system will have an e-mail address. Every account with FB, Google, Twitter is also linked to an e-mail address. What you will need to do is link the accounts based on e-mail address. That way you will never get duplicate accounts.
If you have a web application that will allow the users to opt-in to sharing their activity on Facebook and Twitter I'm wondering what is the right way to architect that social authentication into your application (and what is inline with Facebook and Twitter policies) so that you can tweet and post on your wall.
Do you store the users username and password in your database?
And then call the social APIs with these credentials. From what I have learned so far both these APIs make you do an OAuth redirect thing. Is their a way to do that without the dialog interaction since you now have stored the username and password anyways.
Not sure if this is an issue, but do you have to do two OAuth handshakes one right after the next to post to Facebook and then Twitter for those users that want to share on both.
And would you have to do this each and every time the user shares something?
I just launched TweetDeck and I wasn't required to get redirected through some exchange with Twitter. Confused.
Just need some help and guidance with "how most people do it" for web-based applications.
The less prompting and less redirects the better.
I don't think storing the username and password would be a good way to go since I think most users would object to you keeping thiere usernames and passwords on file. I have not done any work with Twitter, but on Facebook you need to create an App and then ask the user to grant your app rights. These rights require the user to be loged in to Facebook in order to work, unless you request the offline_access permmission. From my experience, the fewer permmissions you request, the more users will be willing to grant you these permmissions. My approach is to always request the minimal permmissions I need to get the App to work. After granting your App permmissions, you need to get an OAuth token each time you want to interact with the user's Facebook account. (These tokens are good for about 60 minutes, as far as I remember) Storing these tokens will not help, since they expire. Hope this points you in the right direction.