Let's assume i have a
mobile app backed up by a
Server. the server is both an Authorization and Resource Server.
Now i want to enable users to register / login to the app using
Facebook API. After the user authenticated through Facebook he gets an
AccessToken. now i have few options:
- send the
accessTokento my authorization server (with user
fbId), make sure it's a real
accessToken, store the accessToken as the user authentication token and manage the Oauth2 autherization process using that accessToken with My Authorization server.
- same as the other but create after authenticating in the server side, create new
accessTokenwith an optional
refreshTokenand never use the facebook AccessToken again (only to retrieve information from Facebook)
- on each call to my resource server, user the
Facebook authorization server(please let it not be the answer (-;)
Also if someone is familiar with a blog post / online resource that discuss such a situation please let me know ( i've failed to find one )