Skip to main content

Design for Facebook authentication in an iOS app that also accesses a secured web service

Image
By User


Goal: Allow a user to authentication with Facebook into an iOS application which requires access to a protected web service that I'm running.



Assumptions: There is a native authentication (and registration) system in place for those users that opt not to use Facebook for sign in.



Details:



  • Assume we want to offer the option for a user to sign in with Facebook without creating a separate account/credential for our system.

  • Because we support our own native auth mechanism (username and password) we have our own user IDs and issue an authentication token that is used for subsequent interactions after the initial credential validation.



I'm surprised that Facebook doesn't have best practices for this in their developer documentation. All the existing documentation is either assuming you are building FB auth into a website, or a standalone mobile app with no service that requires authentication.



Here's my initial thoughts on how this would be designed but want validation on whether it's correct.



  1. Client pops the Facebook iOS Login

  2. UI User signs in with Facebook credentials and gets access token

  3. iOS App passes access token to our server



  4. Our server talks to FB graph API using access token to (a) validate the token and (b) get the FB user ID for that access token.



    e.g. Our server would call https://graph.facebook.com/me/?access_token=XYZ which would return profile info in a JSON object





  5. Assuming it's valid, our server extracts the User ID from the JSON object and checks whether the user already has an account. If so, we issue our own auth ticket to client to use for that session. If user doesn't have an account, we create a new one with the Facebook User ID, assign our own unique UserID and issue our auth ticket.



  6. Client then passes auth ticket back on subsequent interactions that need authentication.



This seems like the right approach to me but not sure if I'm missing something insanely basic and going down the wrong (complicated) path.


Source: Tips4all, CCNA FINAL EXAM
Labels:

Comments

  1. UserMay 21, 2012 at 2:31 AM

    I just dealt with this myself, and here's the part that bit me:

    In your step 5... It's possible for a user to register for an account with you entirely separate from their Facebook ID, right? Then some other time they log in with Facebook.... And you just created them a second account and lost their first one.

    There needs to be a way to be logged in to your web service, then log in to facebook, and capture the association between the facebook ID and the local account.

    Apart from that, your plan sounds solid.

    ReplyDelete
  2. UserMay 21, 2012 at 2:31 AM

    I am trying to figure out how to deal with the same situation.
    The central missing piece to me is in Step 3:


    3) iOS App passes access token to our server


    Please correct me if I'm wrong - but the transmission of the access token is not encrypted - thus anyone listening on the network can replay the token for the length of the session and impersonate the user.

    The solution here would be to transmit over https. Thoughts?

    Either way fantastic post - you provided some valuable insight.

    ReplyDelete

Post a Comment

Popular posts from this blog

[韓日関係] 首相含む大幅な内閣改造の可能性…早ければ来月１０日ごろ＝韓国

By Unknown
Post a Comment
Read more

div not scrolling properly with slimScroll plugin

By User
I am using the slimScroll plugin for jQuery by Piotr Rochala Which is a great plugin for nice scrollbars on most browsers but I am stuck because I am using it for a chat box and whenever the user appends new text to the boxit does scroll using the .scrollTop() method however the plugin's scrollbar doesnt scroll with it and when the user wants to look though the chat history it will start scrolling from near the top. I have made a quick demo of my situation http://jsfiddle.net/DY9CT/2/ Does anyone know how to solve this problem?
1 comment
Read more

Why does this javascript based printing cause Safari to refresh the page?

By User
The page I am working on has a javascript function executed to print parts of the page. For some reason, printing in Safari, causes the window to somehow update. I say somehow, because it does not really refresh as in reload the page, but rather it starts the "rendering" of the page from start, i.e. scroll to top, flash animations start from 0, and so forth. The effect is reproduced by this fiddle: http://jsfiddle.net/fYmnB/ Clicking the print button and finishing or cancelling a print in Safari causes the screen to "go white" for a sec, which in my real website manifests itself as something "like" a reload. While running print button with, let's say, Firefox, just opens and closes the print dialogue without affecting the fiddle page in any way. Is there something with my way of calling the browsers print method that causes this, or how can it be explained - and preferably, avoided? P.S.: On my real site the same occurs with Chrome. In the ex
5 comments
Read more