Using omniauth for facebook connects an existing user with different permissions

Question

I use devise / omniauth to authenticate to facebook and it works fine. However, I would like to add a stream in which an existing (non-facebook) user has the ability to connect his Facebook account. This will require different permissions for facebook. so i can't find two things

• how to use dev / tomniauth to request a facebook connection without logging out of the current user.
• request various advanced user permissions (other than those specified in the development configuration file)

any ideas? thanks

Answer 1

The answer to 1 is pretty simple: just add an if path to the omniauth_callbacks_controller :: process_callback method like this

# If a user is signed in then he is trying to link a new account if user_signed_in? if authentication.persisted? # This was a linking operation so send back the user to the account edit page flash[:success] = I18n.t "controllers.omniauth_callbacks.process_callback.success.link_account", :provider => registration_hash[:provider].capitalize, :account => registration_hash[:email] else flash[:error] = I18n.t "controllers.omniauth_callbacks.process_callback.error.link_account", :provider => registration_hash[:provider].capitalize, :account => registration_hash[:email], :errors =>authentication.errors end redirect_to edit_user_account_path(current_user) 

This is what I do in my application and it works great.

As for question 2, I don’t know how to support two different facebook authentication configurations, but it’s hard for me to understand how this is useful for users, because they need consistent experience in both ways: “Log in using facebook” and “connect your facebook account. " (If you still want to continue this path, one of the ideas I would like to explore is to create a new facebook application with its independent keys and configuration ...)

I hope for this help.

Answer 2

One easy way to implement layered permissions is to use the Javascript SDK for Facebook (in addition to omniauth if you want). You can simply specify another "scope" parameter, which sets the required permissions for every call you want. What I am doing makes omniauth provide a basic set of permissions, after the user connects via omniauth (and thus saves his data in our database), if additional permissions are needed, we will show them JS buttons that provide advanced permission sets. If you want to check what specific permissions you have granted the user, you can simply use the me/permissions API call.