Overview
I am creating a RESTful API application as a mobile / web server (let me call it MyBackendApp), and I am looking for a modern solution for both authentication and authorization of application users. The primary language for the backend is Java. If you look at other applications, many of them offer the user several user methods: using an external application account (for example, Facebook, Google, Yahoo, OpenId, etc.) or internal (email address \ password). Something like Stackoverflow has on its registration / entry sign. I read many sources about OAuth2, I also used Spring Security to implement internal user accounts and session management. But I find it difficult to combine both methods.
Requirements
- I want the user to log in using any of the following methods:
- with an external (possibly OAuth2) Facebook-like account
- using email address \ password
- Role-based access control for API methods. MyBackendApp will have the following roles: application administrator, content administrator, content user, content creator, developer (for other applications to use the MyBackendApp API)
- Like all modern mobile applications, I want the user to remain on until the expiration or cancellation of the session (if you go, as described below, in the thoughts of the current implementation, this can be done with cancellation of the token). And I do not want him to visit the screen every time I open the MyApp mobile application.
Current thoughts on implementation
OAuth2
Facebook, : MyBackendApp .
, authToken Facebook ( Facebook), - , authToken ( , Android SDK, , , ). OAuth, authToken (Facebook).
, authToken MyBackendApp, :
- uniqueId MyBackendApp,
MyBackendApp REST,
( ).
- uniqueId MyBackendApp, MyBackendApp
, Stackoverflow.
email\password auth
Sign-Up. , : MyBackendApp . (, Creat Creator)
Sign-In.
- (WebUI JavaScript\Android\iOS)
- ( MyClientApp) (, , ) MyBackendApp https. : . SSL. (MyBackendApp) .
- MyBackendApp authToken (, JWT) userUniqueId (UUID) .
- authToken API REST
- , MyBackendApp REST, userUniqueId, expirationDate Role allow\disallow the call.
- , " " ? ?
- , OAuth , . , ? , facebook\google\others?
- , , - , ? , Spring OAuth2 OAuth2. (OAuth2 + email\password)?
- post [Apache Shiro] - ? Spring Security OAuth2?
- , authToken MyBackendApp - ? authToken?
- - authToken (, facebook , ), MyApp Facebook - , Facebook, ? ?