I have been building out a server api for mobile developers to use for an iphone app. I have no experience with mobile development and they have no experience with ruby on rails. I have attempted to build a mobile authentication route for the app that allows users to log in via facebook. So far, it looks like this:
GET '/auth/mobile/fbtoken=:facebook_token&device_id=:device_id&time_zone=:time_zone&os_type=:os_type', to: 'sessions#fb_sso'
client = OAuth2::Client.new(
ENV['FACEBOOK_APP_ID'],
ENV['FACEBOOK_APP_SECRET'],
site: 'https://graph.facebook.com')
token = OAuth2::AccessToken.new(client, params[:access_token])
user_info = ActiveSupport::JSON.decode(token.get('/me').body)
The resources online for learning how to do this properly are very limited or nonexistant. The only information I have found on how to do this involves using Devise for authentication. Our app currently is equipped for Devise (it's been added and the migration has been made to the User model) but does not currently authenticate via Devise. One of the only specific examples that I have been able to find for what we're trying to do can be found at the bottom of the page on this post:
https://www.ruby-forum.com/topic/4409930
It led me to believe that I was on the right track with the way the route was set up, because everything is the same besides the last step "sign in using Devise method: sign_in #user, :event => :authentication." This is what motivated me to attempt to integrate Devise into our application.
After reading that, what I meant to do was implement Devise in a sort of limited state and use only the sign_in method. Unfortunately, Devise seems to be very opinionated and more of an "all or nothing" sort of solution. I'm very unsure of how to proceed and how to decide whether to completely rebuild a significant portion of our application to support Devise or to abandon it altogether and try to implement my own solution.
tl;dr
1) Is it worth re-doing a significant portion of the Rails app to use Devise?
2) Is it possible to make this route work without Devise? How?
If you are only going to have your users sign in through Facebook then Devise would be unnecessary as you would just be using Facebook's API with Koala or Omniauth to authenticate the user. On the other hand, I see no reason why you couldn't have both your own authentication and Facebook authentication by also using Devise if you want non-Facebook users to use your app; you would just need either form of authentication to create a session.
And if I understand correctly, the solution at the bottom of your link doesn't use Devise for Facebook authentication but it's used to create a session when a person's FB account has been authenticated. Seems like a reasonable way to go.
To answer your TL/DR:
1) Only if you plan on having both a Facebook login and a traditional login at the same time.
2) Yes. Just give those GET parameters to a gem like Omniauth or Koala and create a session once the user has been authenticated.
Related
As you can see on the image, spotify has a modified version of facebook login.
On the spotify app shown, user can login using either facebook or spotify account.
I wonder if its only on the looks or they were using other facebook authentication process.
I also wonder and worried if spotify could get facebook password entered by the user.
What facebook authentication they were using in here?
As you have noticed, Spotify is using a different Facebook login flow that is not listed anywhere in the official Facebook developer documentation. Since the Facebook password is entered into a closed source client, there is no way for you to know for sure what happens without heavy reverse engineering and debugging of the client. In that sense you should be worried. It goes against and devalues the good policy of "Please don't enter your password anywhere else". Thinking about differently, Facebook trusts this company enough to allow this. There might be a few more companies that have the ability to use this login flow, but I don't know.
I work at Spotify and was there when it was introduced (September 2011). We worked very closely with Facebook (I helped build some parts of the backend integration). It is not my favorite part of the client though. I would much prefer a standard Facebook OAuth 2 authorization flow. That was however one of the main technical problems in spring 2011 when we started to build this. We basically needed to embed a browser in the client to make it work properly or redirect the user to a browser and then back to the client again. There were also other reasons that I can't remember why we didn't do this.
Now when we have an embedded browser (since December 2011) it would be much easier to change. I believe this type of login flow will be phased out eventually.
I have an packaged app in the Chrome Web Store that I'd like to transition from a paid app to a free one with in app purchases. I need to be able to detect if the current user had paid for the app previously.
To be able to use the licensing API, I need the current user's OpenID URL. I was able to get this to work using chrome.identity and a popup dialog that the user has to authorize. But it is a bad experience and kind of a scary dialog.
For hosted apps, it's possible to get the user's OpenID URL without any user interaction or authorization. (see How to skip the OpenID approval screen). It would be fantastic if somebody knows how to make this work without user interaction for packaged apps.
I've detailed some of the approaches I've tried on this chromium-apps thread. I suspect it may be possible to do this with chrome.identity.launchWebAuthFlow but I wasn't able to discover the exact incantation of parameters to google's oauth/openid endpoints to make this happen silently.
I think you need to refer to this Link1 Parameters
this parameters are different techniques using that you can do this task..
also To bypass the Login/approval screen refer this link2
Here in the section How to skip the OpenID approval screen the details are explained which you can use..
And In case of packaged app this should ask for permanent permission that will help in OAuth throughout the life of app..
Client Library JavaScript Based
Authentication using Library
After your comment I thought this you can bind in your app.!!
Let me know what works for you..
I have seen many web apps supporting Facebook Connect...
But when i login through those apps sometimes the authentication is successful but nothing is returned to the app and the login page just goes to a blank page in that new windows and stops... The whole process fails... And this has not occurred once but many times...
So my question is:
Is Facebook Connect a good solution to use in apps or should i use something like Google Login or Twitter Login or OpenID or just a simple password based login or all of the things and let users choose what they want?
And if your answer is app the solutions then wont my database become messy and the app slower because it has look for more data now?
I know it depends on various factors but I just want your opinion, what would u choose and why?
Supporting Facebook connect as login function make sense only if your app has something to deal with Facebook (which is the most of our app today ;-)).
The behave of some app when sucessfully Authenticated and then Authorized is up to these app.
FB login give you all the tools to build you own user experience.
The things become a bit more difficult when you want to introduce FBConnect within already existing login base, while you have to find a way to bind the Identified FB user with your user account.
I have a Rails application for which I use devise to authenticate my users and this works great. I now want to write an iPhone application (not just a WebUI but a proper APP) that accesses the same data and so requires the same authentication. How should I go about doing this?
I want to login using devise and keep the session open so that queries back and forth work as they do on my website. I am very new to both rails and devise.
I'm trying to do the same thing actually. I also have a Rails application, using the Devise Authentication Gem that I would like to create an iPhone App for. I don't know if I have a good answer for you yet, but here's some things I've learned along the way...
According to the README on the Devise GitHub page, it seems that Devise is implementing RESTful authentication with these 2 modules:
Database Authenticatable:
encrypts and stores a password in the database
to validate the authenticity of an
user while signing in. The
authentication can be done both
through POST requests or HTTP Basic
Authentication.
Token Authenticatable:
signs in an user based on an authentication token
(also known as "single access token").
The token can be given both through
query string or HTTP Basic
Authentication.
With HTTP Basic Authentication, your iPhone app won't have to re-authenticate with each request. You will only have to authenticate once, then the framework will remember that it has authenticated.
A few resources that may be helpful for you getting started:
ASIHTTPRequest
Objective Resource
This is a very general answer, but you probably want to use a webservice, in this case exposed within the devise api.
On the iPhone side, it's a web service call, see the docs for "URL Loading System Programming Guide" in the iphone sdk, or maybe this answer: Using a REST API and iPhone/Objective-C
This link answers the question of how to auth an Objective-C app against rails and store the login/password in user defaults for later use:
HTTP authentication between devise and iphone app
Use the method above to add authentication to your Cocoa / Objective-C / Iphone / Mac OS X app against a Ruby On Rails backend.
For a middleware system with internet (which works inside a set-top box) I want to develop a primitive Facebook interface where users can type their user-names and password, showing their latest notification, messages and other casual stuff on the TV screen by using the recent Facebook Graph API.
This middleware program uses Java ME to run programs (such as this simple facebook app) and it can connect to internet however it doesn't have a real web browser. Without browser it can connect to any url to retrieve the JSON response however I am not sure how to achieve authentication without a real browser.
Under this circumstances, is it possible Facebook authentication? If you think so, what approach would you suggest ?
Thanks
Facebook provides trusted partners with a private Authorization API to get an OAuth 2 token from a username / password.
A more complicated approach would be doing something similar to how Netflix enrolls a device:
device calls server to obtain a Code
device shows code on screen and directs user to go to URL on server and enter Code
server redirects user to Facebook and obtains OAuth token, user told to go back to device
device calls server with Code and obtains OAuth token
device can now make calls directly on behalf of user
According to this documentation on "Desktop Application Authentication" I don't believe your desired result is possible:
Facebook's OAuth implementation does not include explicit desktop application support. However, if your desktop application can embed a Web browser, you can add Facebook support to your application easily using the same OAuth User-Agent Flow used by JavaScript clients.
However, it is clearly possible for certain vendors to do this, since Microsoft's Xbox 360 Facebook application does exactly what you are proposing. I'd be interested to see if anyone has dug up any API for doing this that Facebook doesn't want in their most obvious documentation.
This isn't an answer but I'm trying to do the same thing. Check out this guy's blog which uses another server to proxy the requests:
cory wiles blog
If you figure it out please post a detailed answer here so I can do it to.. :)
I think it is possible though it is pretty complicated and subject to sudden changes of Facebook interface. It might break the agreement between you and Facebook.
What you do is to emulate the Facebook.
One path you have to set up a Facebook application. Once you got the authorisation from user, you can to something with Graph API.
You need to the Facebook log-in process and authorisation process. There are some capturing tools on http/https request and response. Analyse them, both header and body.
Once you know the authorisation mechanism, you can replace it with you own. Everything afterward is on Graph API.
Another path is to emulate Facebook login and message and notification process. Capturing and analysis is needed.
In the past I have used a tool called screen-scraper (full disclosure: I used to work there) to automate logging in to facebook. Basically, it imitates a browser session; it allows you to set session variables (i.e. username, password) which would then be submitted to facebook, just as if the user had submitted them in a browser.
You may not be able to use screen-scraper in your set-top box environment (although it is java-based, so it's possible it would work). Even if it doesn't, you could implement a similar strategy in java, making the HTTP calls a browser would make to load the login page and submit the user's credentials. To keep the user's info safe make sure whatever HTTP client library you use supports HTTPS.
Proxy tools and extensions like Charles, Fiddler2, Firebug, Chrome's dev tools, etc. are helpful in seeing exactly what the browser is sending to the server in requests.