Let's assume i have a mobile app
backed up by a Server
. the server is both an Authorization and Resource Server.
Now i want to enable users to register / login to the app using Facebook API
. After the user authenticated through Facebook he gets an AccessToken
. now i have few options:
- send the
accessToken
to my authorization server (with userfbId
), make sure it's a realaccessToken
, store the accessToken as the user authentication token and manage the Oauth2 autherization process using that accessToken with My Authorization server. - same as the other but create after authenticating in the server side, create new
accessToken
with an optionalrefreshToken
and never use the facebook AccessToken again (only to retrieve information from Facebook) - on each call to my resource server, user the
Facebook authorization server
(please let it not be the answer (-;)
Also if someone is familiar with a blog post / online resource that discuss such a situation please let me know ( i've failed to find one )