Alex Rivera | Logout

Authenticating with OAuth2 for an app *and* a website

Asked 2012-07-24T13:28:46.340
69

I'm developing a website that is primarily accessed via an app, and I want to use OAuth2 for user registration and authentication. Since it is an Android app I will start using Google's OAuth2 stuff, since it provides a decent UI on Android.

Google states that "You can choose to use Google's authentication system as a way to outsource user authentication for your application. This can remove the need to create, maintain, and secure a username and password store." which is what I want to do. However when I go through all their examples and whatnot, I can only find stuff about having a website or an app authenticate a user against Google's services.

And indeed, when I go to register my app ("client") with Google's OAuth2 there are options for website clients and "installed" clients (i.e. a mobile app) but not both. I can create two separate clients but I read the OAuth2 draft and I think there will be a problem, which I will now explain.

Here's how I did envisage it working:

OAuth2 flow diagram

  1. User asks MyApp to access his private data.
  2. App uses Android's AccountManager class to request an access token for Google's APIs.
  3. Android says to user "The app 'MyApp' wants access to your Basic Information on Google. Is this ok?"
  4. User says yes.
  5. AccountManager connects to Google's OAuth2 server using the credentials stored on the phone, and asks for an access token.
  6. Access token (which follows the green lines) is returned.
  7. AccountManager returns the access token to MyApp.
  8. MyApp sends a request to MySite for the user's private data, including the access token.
  9. MySite needs to verify the user, using the access token. It validates the token android oauth oauth-2.0 google-authentication
Edit
Report

1 Answer

1

You probably need OpenID Connect, which uses OAuth tokens for authentication. As for AccountManager, the current OAuth support is a bit hacky, the new Google Play Services, set to be released 'soon' should hopefully make this better. See here for a demo.

answered 2012-07-25T02:57:06.930

Your Answer