I have created an API that uses the FOSUserBundle and the FOSOAuthServerBundle for user accounts and Authorization.
Is it possible to add, login via facebook or google, functionality using the FOSOAuthServerBundle?
I have seen people mentioning the HWIOAuthBundle as a way to integrate Facebook and other social logins. I have not seen an example of integrating the two bundles (FOSOAuthServer and HWIOAuth) so that users can create accounts on the system and authenticate (FOS) while at the same time being able to create accounts / login via FB (HWIO).
I found this post about using custom grant types with FOSOAuthBundle:
http://blog.tankist.de/blog/2013/08/20/oauth2-explained-part-4-implementing-custom-grant-type-symfony2-fosoauthserverbundle/
The idea is to create a service that takes the facebook token and validates it with facebook. If successful an OAuth Token should be returned.
The HWIOBundle is not necessary
Related
Currently, I have Google, Github, Twitter account registration/login (merge them by email). But I want to give a currently logged-in user ability to manually connect another social account (with a different email). For authorization, I use JWT and store them in localStorage on frontend.
The problem comes when we redirect user to some of social login providers and when he returns back we don't know who it is. It can be user that connects an additional social account to the main account or a new user that firstly login by some social provider.
What possible solution for getting logged-in user after redirect from Social login provider when using JWT for auth?
or
What best solution for linking social account to existing main account when using JWT for auth?
By "social login provider" I mean Github, Google, Twitter, etc
Ok, I just create separate routes for connecting and store JWT in cookies to ease auth check.
I m building a website and a mobile application where both of them uses common resources from my server using APIs. Is it possible to use Social Login like Facebook / Twitter / Gmail to authenticate users to use my application? This will benefit me by not creating my own security layer and rely entirely on their security mechanism to secure my APIs.
OAuth documentation states that Users grant access to their Protected Resources without sharing their credentials with the Consumer.
In my case, by giving Login via Facebook, I want these Facebook Users to login to my application and use the Protected Resources which are exposed by my APIs.
Let me know if I am on the right track or not ? How do I achieve this.
Of course you can use Facebook (or Google+) for a login mechanism on your website.
Facebook offers a button for this: https://developers.facebook.com/docs/reference/plugins/login/
Here´s more information about the Facebook login: https://developers.facebook.com/docs/concepts/login/
If you don´t want to use the Login Social Plugin, the best way is to use the JavaScript SDK: https://developers.facebook.com/docs/howtos/login/getting-started/
Google+ offers a login button too: https://developers.google.com/+/features/sign-in
I did not use the Google+ solution yet, but with the Facebook login it´s quite easy. You can just store the Facebook ID for registration and stuff.
I am trying to use facebook API to provide a silent login feature.
Application has to login onto facebook without prompting for user name and password. The authentication can be done through the application.
I want to know whether this can be done using the facebook API. I'd also want to know whether some paid facility is available to do that.
Facebook does not support silent login. Facebook only permits authorization through its own servers and browser windows, because it does not trust third party developers to handle their passwords.
You will have to authenticate once, then get an access token, and you can keep using the access token to auto login the user, until it expires. Have a look here or search google on "how to get Facebook access token c#"
Auto Facebook OAuth from ASP.NET C#
I was just wondering, I want to associate a Twitter and LinkedIn account with my systems accounts. Which would allow them to post to interact with them without needing to log in to the other systems.
Is there a way to store the social (twitter / LI) usernames and passwords and associate them with my system and vis versa.
E.g. If I login using my native details (email / password) I can access the API features of my social network accounts?
Thanks in advance,
Chris
I can't speak for Twitter, but with LinkedIn you could follow this basic workflow:
Register an 'application' with LinkedIn. Your site will use this application for all communication with the LinkedIn API.
Have the user authorize your site (your application really), to access their account via the LinkedIn API.
Retrieve the user's unique LinkedIn ID, as well as their access tokens, and store those in your user account database, associated with their existing account.
Then, when they return and log in to your site, any calls you need to make to LinkedIn can be done via the stored access token, rather than having to have them manually allow you to have access again.
I am using Twitter API for retrieving user information for specific name searches. The method I am using is users/search. You can find details of this method here: http://apiwiki.twitter.com/Twitter-REST-API-Method%3A-users-search.
Right now I am trying to use OAuth in my application as Twitter announced that they will no longer support basic authentication. The issue with using QAuth is that I don't require the users to connect to their Twitter account and so I can not generate user token. My application is using Twitter just for showing information about people, it's not posting/updating anything. I will really appreciate if anyone has any suggestions on using OAuth for Twitter without using Twitter user's login information.
I would suggest that you create an account for your application and use that account to perform user search if your application is a webapp.
If your application is an desktop app, I think it's understandable to user that they need to authorize your application to do the user search.