In my symfony project, I have integrated HwiOAuthBundle for different social logins (twitter, facebook and google) and everything is working perfectly. We are collecting the oAuth tokens for each of these providers as well as the user id.
Now my question is, how can I make an Authenticated API call to one of these services using these tokens with the help of HwiOAuthBundle (or any other way) from my symfony controller
Any help will be highly appreciated.
For facebook, just call the graph API passing it the FB access token you saved in your DB: https://graph.facebook.com/.....?access_token=
same for linkedin, just use oauth2_access_token= instead
probably same/similar things for the other providers
Worked for me.
Don't think that it is possible to do what you're asking. HWIOAuthBundle don't even save the tokens to DB by default.
Once you have the token, I think you need to use bundles/wrappers dedicated to each API.
Related
I hope not to be duplicating any question, and also not to be asking something too basic.
I´m building a web app in ReactJS, just to get familiar with the framework. I planned to grant access to users using a Facebook login, which I already have working with react-facebook-login. I also have a Spring Boot Rest API, to serve the front-end. But I want to allow access to part of my API just to authenticated users, using the Facebook access token. So in my back-end, I had to do an org.springframework.boot downgrade from 2.0.4.RELEASE to 1.5.10.RELEASE so I can use the Facebook Graph API. Do you guys think this is ok? or should I use a different approach?
And to be honest I´m a little confused on how to achieve a correct validation of the user's request on the restricted areas of my REST API using the access token sent from the front-end, Do you guys have any suggestions on this matter?
Thank you all for your help.
I'm a bit confused about Identity Providers in a project I'm doing with Xamarin Forms.
I configured Facebook as an IP with Azure Mobile Apps following this page
https://learn.microsoft.com/en-us/azure/app-service-mobile/app-service-mobile-how-to-configure-facebook-authentication
It works, but my doubt is, how can I use the MobileServiceUser result of the authentication process to, for example, post to Facebook or get personal information from Facebook. Is this possible?
Thanks!
This is how I think about it.
Identity providers are used to provide a third party guarantee of WHO a user is.
The Mobile SDK lets you do Authorization. So you can decide WHAT the user can do on YOUR service after you know WHO they are.
Any thing you are doing via facebook would still need to be done through the Facebook API/SDK using the token their Authentication process returned to you.
Finally I found the solution to my problem.
What I was trying to do is get information from Facebook after I have authenticated myself.
All I had to do was invoke
await client.InvokeApiAsync("/.auth/me");
After authentication and thats all, the response of that request has the token to access the Facebook API. These tokens are saved in Azure.
For more information:
https://cgillum.tech/2016/03/07/app-service-token-store/
Thanks!
In version 1 of my website, i implemented Facebook Connect with the JavaScript API. This included authentication, permissions, and publishing.
In version 2 of my website (what i'm implementing now), i have implemented Facebook Connect with the Graph API (OAuth).
I haven't touched the Facebook settings in my application. But when i attempted to authenticate using OAuth, it asked for the same permissions again (email, basic information) - even though i had already granted those before (using version 1)
The only difference i can see if that previously i asked for permissions via FB.showPermissionsDialog, now i use the scope parameter in the login page URL (OAuth).
What this means is when i go live, all my users will have to re-authorize my app, when they in fact shouldn't.
Any ideas? Is it because i'm now using AppId/Secret (OAuth) instead of ApiKey/Secret (JS API)?
FYI i'm using the Facebook Connect C# Toolkit.
I don't think that makes sense. Are you using the same application id? The permissions are between the application and the user, as far as I know.
Problem goes on unsolved, but site is live so not much i can do about it now.
Not a huge deal anyway.
I think you need to validate your oauth using javascript-sdk:
Check this response hope this gives you some idea.
Firstly I understand OpenId is for authentication and OAuth is for authorisation and unlike other questions on the site I am not asking which should be used for which but whether anyone can advise a solution for my issue.
I want to allow users to login to my site via their LinkedIn/Twitter/Facebook account once logged in say via LinkedIn they could also then authorise their Twitter and Facebook account as a optional login method. This would allow the user to authenticate via any of the three but end up with their user account on my site as the end result.
I also want to use the authorisation they have provided to get basic user details (profile pic/name etc) and post status updates.
I don't want to ask a user to login with their account via openId then have to authorise the same account again via oauth to allow my site to publish to their service feed and have to do this for each of the 3 services.
Any ideas or issues to this issue?
If you are using ASP.NET MVC, DotNetOpenAuth is an excellent solution for supporting OpenID/OAuth sites. StackOverflow is using it, and they are quite picky for the code they use in the site.
The integration if OpenID with DotNetOpenAuth is quite straightforward. I have not tried OAuth, but I don't expect it to be of any less quality.
Unfortunately, Facebook does not support OpenID/OAuth, so you need to use a different solution for it. The one I use is Clarity Consulting's Facebook Developer Toolkit. It works, although I do have certain complaints about the quality of the code; unfortunately I haven't found anything better yet. (Note: If anyone knows a better alternative, by all means let me know)
The basic integration of Facebook Connect with the Facebook Developer Toolkit is also relatively straightforward. However, their object model is somewhat messed up, due to their attempt to stay as close to the Facebook APIs, so the HTTP API patterns are bleeding through a lot. Still, it does the work.
Update: Now that Facebook announced that they'll be supporting OAuth 2.0, DotNetOpenAuth might turn out to be the best solution.
Have you looked into RPX?
https://rpxnow.com/
I don't want to ask a user to login with their account via openId then have to authorise the same account again via oauth to allow my site to publish to their service feed and have to do this for each of the 3 services.
I'm afraid you'll have to connect the user's account to each of the 3 services individually. What platform are you using to build your app? If it's Ruby, then a gem like OmniAuth looks promising.
I am wondering if anyone has an idea on how did twitbird developers use oauth for allowing the user to authorize their app ?(they say that they did use OAuth)
when I was trying their app they used the username and password directly without redirection to twitter.
I searched for a solutions and there is no obvious answer because as far as I know OAuth doesnt allow the 3rd part applications to use the user's password..
Thanks in advance
Twitter has a new OAuth method called xAuth. It takes your username and password and does a one time exchange for OAuth access tokens which are then used for normal OAuth.
http://apiwiki.twitter.com/Twitter-REST-API-Method:-oauth-access_token-for-xAuth