I have an application that does something similar - we use Open ID and OAuth exclusively for logging in, and while we save the user's email address (a Google or Facebook account sends it during authentication), they never use it , t / need a password.
This is a callback for what happens when a user signs up via Facebook:
User.create!( :facebook_id => access_token['uid'], :email => data["email"], :name => data["name"], :password => Devise.friendly_token[0,20])
Devise.friendly_token[...]
just generates a random password with 20 characters for the user, and we use our User model by default, and the application is just fine. Just setting a password in the same way for your users will be my approach as you will never use your password. In addition, if you ever change your mind and want them to be able to log into the system, you can simply change the user password in the database and create a login form, and the development will take care of everyone else.
source share