PS: I understand the concept of OpenID authentication and Oauth authorization (i think). And i am using facebook as an example of Oauth
It has been a trend for Websites to asked you to "signup" by "login with facebook" but during the signup workflow (after receiving permission and member info from your facebook account) they still ask you to pick a username and password. Which creates a local user and "links" that user to said facebook account.
But now i noticed during the signup process for websites like buzzfeed and even stackoverflow, they seem to be doing full authentication with facebook. You grant the website permission to you facebook account, and you are now logged in (as sort of a facebook user)
update (corrected authorization to authentication):
Does this mean facebook connect now does "authentication"? and does this mean users are no longer stored locally?
In the case of stackoverflow, I think they create user account internally, however they create username on behalf of the user - like user1243534, if the user does not specify his own. This internal account is used to store all stackoverflow related information for the user, that does not exist in facebook (or other provider) - reputation, questions, answers, everything.
If in your case, your web application does not need to story ANY data related to the user, except session with some session temporary variables (that he is logged in with facebook, his facebook name, etc.), then you can omit local user storage and accounts. In that case your application will lose any data related to the user, when his current session expire.
However, if you want to store whatever data in regard to your users, e.g. how many times he logged in, what language he prefers, persistent settings, or anything that is not stored in the provider, you should create your local user account.
Your first question: Yes, facebook is authenticating each time the user wants to log in, if no other authentication process is provided.
Your second question: Depends if you'd like to store user data for more time than the session duration (user data that is not taken from provider).
Related
I am trying to have a custom facebook login page in my react meteor app. For example, I have my custom input fields (username and password) and I am trying to pass username/password values to facebook and validate. I do not want to use meteor account-ui. I found Meteor.loginWithFacebook which only checks to see if user is ALREADY logged in. Can someone help me to understand how I can use my custom username/password fields to get facebook user data?
Answer: That is not doable (or at least, should not be done, even if some workaround or hack exists, which I am unaware of).
What you can do is create your own authentication system, and give the user the option of either filling in the user details themselves, or using facebook login to fetch it from facebook. That ways, you have your own authentication, and also user's facebook profile.
Explanation:
The whole point of having openid (facebook, twitter, gmail, etc authentication) is to make signing up for a website/app convenient and SECURE.
If you use your custom user name and password field, then you can even store them, and that can give you access to user's facebook account. Even if you were not to do that, someone can easily hack into your website and steal the data to get access to your user's facebook account (your application would be way easier to hack into compared to facebook).
Hence, the facebook login api is such that the very sensitive task of accepting user name, password (facebook would never trust anyone else to do that for it), and validation of user is done by facebook, and you are given a token which tells you the user is logged in, and his basic profile (if you ask for it), and you do not have to worry about security, and the user himself feels safe, because he knows he is typing his user name and password in facebook.com, and not in somexyz.com
Am I allowed to create an app that only invited people can join?
Or do all apps have to be open to everyone?
You can have a white list for people who are allowed to use your app in your database and ignore any request for other people.
EDIT:
As per the question in the comment section, I will give you more details. I have not quite done exactly this, but I can guarantee you this is possible. I have a website, linked to Facebook and people can log in to the site using Facebook. In my database I am storing the Facebook ID and the Facebook user access token. When a user clicks on the login with Facebook, his Facebook user access token is checked against the database. If the Facebook user access token (which works like a temporary password) expires, it is renewed. However, people are identified by their Facebook ID. I could easily have a white list for Facebook IDs and allow access only for people whose Facebook ID can be found in the database. My project strategy is to get as many users as possible, but I could easily modify this to restrict access for not verified people. Your problem with consistent login probably lies in the fact that the Facebook user access token expires in a few hours. However, that problem is solvable:
if the user has modified his Facebook password, or has not connected to the app, then he will be asked by Facebook for permissions
if the user is no longer logged in, then he will have to log in
if the user's Facebook user access token has expired, then you should generate a new Facebook user access token
finally, you can generate long-term Facebook user access tokens, which last for months.
Read the documentation for details, but keep in mind that things might have been changed at Facebook since the documentation was written, therefore you should not believe everything written there, but should rather test the validity of the most important statements.
I need to implement a system to retrieve information from a user of facebook independently of the user being logged into facebook.
I have user access token in my database but every time the user needs to login on facebook.
My question is how the authentication of Hootsuite (hootsuite.com) works because there it is not necessary.Just logging in the Hootsuite is possible to recover all data from facebook.
What you are talking about (If I understand you correctly) is a breech of privacy in the eyes of Facebook. A user has to be interacting with an application in order for it to retrieve information about the user.
Facebook's API access works by means of an access_token that is specific to the user and the application that requested it. access_token's have a limited time frame that they are valid, after that the application would have to request a new one or request an extension on that token. In either case, the user would have to be interacting with the application, and therefore logged into Facebook, when such a request is made.
I'm unfamiliar with the website you referred to but it is not in the scope of this site to reverse engineer some one else's application.
I'm trying to implement facebook connect to my website, and i have couple questions.
1: Is it possible to register user in my website using his current facebook email/password.
Let's say user clicks on link Register via facebook and then he have to give me permisions to access his password, email, etc... and after that is done i put that info in my own database and he will be able to login with that account any time he wants without needing to give me permisions any time in the future.
2: If that kind of registration is not possible, what's other solution would be the best for me? Because i need to somehow keep track of that user who logged in with facebook, because he can upload photos, send messages etc.
Anyways, i'm quite new with facebook and similar things, so i'm really lost here, hope some one can help me :)
EDIT Thank you all for wonderful answers it helped me a lot, now all that's left is to read documentation :)
Yes it is, it is possible to get the information of the user. But it is rather complicated, when you have never dealt with it.
First you need to send the user to the following link:
https://m.facebook.com/dialog/oauth?client_id=your-client-id&redirect_uri=xxx&scope=listof-information-you-want
Facebook will then return your client to the uri specified, if the user rejected it will give a reason. If it is not you will get an code in urlencoded format.
This code is needed for the following step, the request of the access token:
https://graph.facebook.com/oauth/access_token?redirect_uri=xxx&client_id=xxx&client_secret=xxx&code=xxxx
This will give back an access token, if the authorization didn't fail.
After that you can ask for the information you want:
https://graph.facebook.com/me?method=GET&metadata=true&format=json&access_token=access_token
This will include a facebook uid, which is unique for all users. Store it and you can discern between a register and login.
This is roughly the process for any oauth2 application.
Facebook will not ask repeatedly for permissions after the user granted them to you. So you can store the access token and reuse it for backend stuff and also use the same procedure you use for register for login.
You can never access the user's password from Facebook even with his/her permission, so the user will always have to authenticate via Facebook and have Facebook pass you the user id of the logged in user once authentication succeeds. You can store all kinds of other data locally, but not enough to authenticate the user yourself.
Once the user is authenticated, you'll have access to the user's Facebook user id via the API, which should be enough to connect all kinds of information to that specific user.
Facebook does not provide access to accounts when passwords are taken from your controls. It provides it own canvas for login information. Therefore you cannot use your first approach to store passwords in your databases. Check this out.
You can however store email addresses once user logins into his account using the facebook sdks. Check this out link for the example of C# SDK sample code.
You can use the Facebook APIs to fetch user email-id, photos, friendslist and other information and then play around accordingly.
You don't get access to the users password - only email if you ask for it.
Best way would be to have a table of users and their Facebook account id's.
If you want to allow users to sign up without Facebook then have a nullable field for their password and facebook id, and also have a field for username - which you could populate from Facebook if they register via that route.
I have a mysql membership database run by a Perl script. Account creation or login requires an email address and password. The Perl script then sets cookies (password cookie has encrypted value) which allow users to create, own and modify records. A members table contains user information. I've gone through the FacebookConnect information as well as the forum. Maybe I cannot see the forest for the trees, or maybe this is not possible. In order to use FacebookConnect for logins/account creation, I need to be able to send the user email and password to the the Perl script so that the proper cookies are set. If it were an http it would look like this:
http://domain.com/cgi-bin/perlscript.pl?_cgifunction=login&email=ddd#somedomain.com&password=somepassword.
Any hints or advice would be greatly appreciated.
What you are trying to do isn't really possible in the way that you're describing it.
Facebook Connect basically provides you with a single piece of information: whether your visitor is logged in to their Facebook account or not. If they are, you can get their Facebook ID, if not, you can show them a button (or whatever) and ask them to log into Facebook.
Generally a good approach when using Facebook Connect as an authentication method for your site is to have an internal id for the user's member account, and store a user's Facebook ID alongside that. When a user comes to your site, and they are already logged in to Facebook, you just use their Facebook ID to retrieve the local account. Otherwise you show them your login form to log in locally, and/or a Facebook login button.
The problem you're running into here is that you cannot get someone's email address from Facebook, as it is purposely hidden to protect privacy. If your membership scripts provide only the email/password log-in method, then what you need to do is modify these scripts to create the authentication cookie when given a properly authenticated Facebook ID.
Essentially you'll have two login functions... one for a Facebook login, and one for a regular login. Either function should properly created the local authentication cookie.