Using OAuth, but storing additional information in my own DB

Question

I looked at OAuth for a while, but have not yet implemented it in any of my applications. I have problems understanding the full concept, so I still have some questions that I couldn’t find an answer to, so I hope someone can help me.

I want the user to be able to run my application (WP8), log in to facebook / twitter / microsoft / .... When he receives authentication, I want to actually save this user in my own database, so I can add some user things, such like settings, messages, ....

What do I need to save in my own database to indicate the user? Do I need to save the token itself or something that after some time will be invalidated? Or do I need to provide a username? In other words: what can I use as a unique identifier?

And what happens when a user authenticates with facebook, for example, and he deletes his account?

And one more question: can you ever let a user connect to an application with two different service providers? If so, how would you associate these 2 providers with 1 user in your own database?

Hope my questions are clear enough! If not, feel free to contact for more information!

Yours faithfully,

Gert

Answer 1

I assume that you have your own back-end where you authenticate your own users, and your WP8 application is just a client.

First, let me distinguish between user credentials and user profile. User credentials are what checks who the user is, for example. username / password, facebook username containing a valid authentication token. A user profile is what you store in your own user database.

You also need to distinguish between the token you use to authenticate the user, and AccessToken Facebook should give you access to user data.

So ... to answer your questions:

What do I need to save in my own database to indicate the user?

Create an entry with user data (e.g. preferences and a unique user ID) and a login method (e.g. Facebook) and credentials (e.g. Facebook user ID). This is your user profile.

Do I need to save the token itself or something that after some time will be invalidated?

You can also save Facebook AccessToken here if you have been granted Facebook “offline access” privileges, but they are used to access Facebook to you ... not by user access to your application / server. For user access, you can simply use a mechanism similar to cookie-based authentication - it's up to you. You can use the AccessToken as a kind of cookie, but you should always check that it is valid.

In other words: what can I use as a unique identifier?

You can consider the Facebook identifier as unique (if you never allow another account in your user profile to profile the link with the same Facebook account)

And what happens when a user authenticates with facebook, for example, and he deletes his account?

It’s a good idea for users to still create a username and password combination that works on your site, and only for the convenience of using Facebook. In either case, Facebook provides a “Deactivate Callback URL” when creating an application profile on Facebook. This is called when a user deactivates your application or deletes an account using Facebook. When you receive this call, you can send an email to your user via the auth link to set different credentials so as not to lose access.

Would you ever allow a user to connect to an application with two different service providers? If so, how would you associate these 2 providers with 1 user in your own database?

Of course you could do it. Suppose you also want to enable your Twitter account. You need to add the Twitter user ID field to the user profile database.

Here's another tip: create an ASP.NET MVC4 project in Visual Studio - the template includes an example of setting up a user profile database with an OAuth login.

Hope it gives you a high level review for further study.