Can I restrict the users who connect via Facebook Connect? - facebook

I am building a website and I want it to integrate with Facebook Connect.
I want to restrict the users connecting to only those who are part of a specific Facebook group or let them connect and have an admin approve their account. Is this possible?

This should be quite achievable.
Present an entry page on your site that requires the user to log in with Facebook Connect. (See "Authenticating Users with Facebook Connect"). Once they're logged in, you will be provided with a Facebook session id specific to that user. You can use that session id to query for user information, either inside the page with the Javascript API libraries, or server side (see "Using Facebook Connect with Server Side Libraries").
One of the API calls is groups.get, which will return the groups that the user is in.
You should be able to retrieve the user's associated groups after they've logged in to Connect, and as part of your page load process check to see if they're in the right group. If they're not, simply re-direct them appropriately.

Related

Facebook connection logic

I can connect to facebook and check on my users and link their account with their facebook profile. But I a question about logic.
When the user comes back to my site, and then want to login again (using facebook), do they have to also be logged in to facebook at that point?
I am using the PHP SDK
If they are logged in before they get to your site, the users will directly see contents allowed to authenticated users. The identification information can be stored by the client's browser (cookies, cache, session...) for automatic log in.
Whenever a user is connected through fb services within a session, his credentials are the same on all websites using fb services within this session.
Hope it helps.

Facebook connect and account remove

I have a website where users can log in with the Facebook oAuth API.
Once the user logs in or registers via Facebook it is stored in my database.
But what I'd like to achieve is, once the user goes to his Facebook application settings page and removes my website app permissions, the used should also be deleted from my database.
Is there any work around to this problem, if this is not possible via the Facebook oAuth API?
You can add Deauthorise Callback URL by Navigating to Settings > Advanced section of your application. Whenever a User Deauthorises your Facebook app, Facebook performs a HTTP POST of signed request to your URL. You may use the field user_id to determine which User has deauthorised your app.
Actually, I would do the following:
Add a date to his last log in to your site.
Have cron job check for old, unused accounts.
Send an email to the user's email address (or Facebook message mail) telling him his account is due to expire soon.
Delete account from database.

facebook login form on third party website

Facebook is blocked by my company firewall but I want to develop an app where in employees can click a link we send it to their email and provide access to their facebook account and update. Firewall blocks facebook.com so I cannot have users type their username and password on facebook.com url. Can I have users type in their username and passowrd on internal website using which the app will login and get access?
it goes against the purpose of oauth to take the user's password and use it to log in as that user. oauth is designed so that the user will never have to disclose their password to your app but still be able to provide your app with some of their own facebook data. this way, only the facebook data which the user chooses to share will be available to your app. also the user may choose to allow your app to publish on their behalf, see here for the details.
my suggestion would be to get the users to authenticate your app from outside the work network (where the facbook.com url is available). this way you can still post on their behalf and your app can get certain information from their profile to relay on to them without you ever needing to know their password.

Login system like Disqus for Twitter and Facebook

How do they manage to get user to login to Twitter / Facebook through Javascript so smoothly?
I am trying to replicate it for the web app. Basically, the user only needs to add a javascript snippet to their site to kickstart but I am clueless as to how to integrate facebook and twitter connect seamlessly.
Do they store access tokens after successfully authenticating a user?
Short answer is yes, they store access tokens after successfully authenticating a user.
After you try facebook and twitter apis, you'll see that, they both returns ids for every user who succesfully logged-in through your application. You can then simply add those ids pairing with the platform they logged in to your database. You can then use that data to track users easily.
You need to
Create applications on both platforms
Have pages for each provider to check if user performed a succesful login
Check if user is a newcomer and add that user to your database if so.
Set a session or cookie variable of user's local id in your own application or do whatever you are normally doing to track if a user logged-in as that user is your local user.

Facebook Connect api in php

HI, I hava a website in php where i have integrated a Facebook Connect API which enabled the Facebook login button.
I login using the button by providing my Facebook credentials. It gets logged in. I can access my profile picture, full name and some other information. But i can't access the user email id i.e. the Facebook user id. I have checked the FBML page here but i didn't get any tag that may give me the user id. I guess that Facebook might not allow me to get the id.
Please help me how to get the Facebook user id from the Facabook Connect API.
Apparently, Facebook uses an numeric increment ID instead of email addresses to uniquely identify each User entity. By Facebook API policies, email addresses are protected to prevent spam and other issues.
In order for an application to get the email addresses of a Facebook User, you will need special permissions from the User. See the API for such permissions.