I have three actors:
What I would like to be able to do is this:
How do I go around doing that? I am reading through OAuth documentation but I am struggling to understand what are these "something" and "something else". Any help will be appreciated.
I have solved this, but I am not sure if this is the best way to do it.
For Google, I send user uid and authorization token that I have obtained in the app by GoogleAuthUtil.getToken()
. On the server, I go to https://www.googleapis.com/oauth2/v1/tokeninfo?fields=user_id&access_token={token}
, where {token}
is the token I received from my mobile app. If the user_id in OAuth2 response matches the uid
that was supplied by API and the uid
matches for some user record in my database, that user is considered authenticated.
For Facebook, I do the same thing, except I use session.getAccessToken(...)
to obtain the token on the app side and https://graph.facebook.com/me?fields=id&access_token={token}
to verify it with Facebook.