Best way to allow users access to your app using their Google credentials

Question

If you have an Android application that requires user registration and you would like to allow your users to login via Google, how would you handle this ?

I would like to keep Google+ sign-in out of the discussion here. We're also not using the user credentials to access Google APIs and I'm not interested in additional access to social features of Google+.

There seems to be a number of options:

Use OAuth2.0 for authentication

Documented in the Google OAUth2 Login page

This doesn't really mention Android but it is (partly) based on OAuth2 access tokens but more importantly on the validation of a JSON Web Token id_token.

This way of authenticating users also involves launching a WebView to allow the users to login to their google account and a rather complex verification of the id_token.

Use OAuth2 / Google Play Services

There's a sample in Google Play Services that focusses more on authorization. It uses GoogleAuthUtil.getToken to retrieve an access_token. A part of it is definitely authentication, as the dialog states "Sign in to ...".

Am I correct to assume that it's a bad practice to use the OAuth2.0 flow with access_token as an authentication mechanism ? (storing the access token as an authentication token).

Supporting Facebook / Twitter logins

The reason I'm asking is because of the way Twitter and Facebook recommend you to implement a "Sign in with ... " authentication process

• Implementing Sign in with Twitter
• Facebook Login Flow for Android

This also seems to be based purely on OAuth access tokens.

Any other options I'm not aware about that allows you to authenticate users with their google account ?

Answer 1

What you need is this http://android-developers.blogspot.com/2013/01/verifying-back-end-calls-from-android.html

i.e. get an ID Token and use it to sign-in to the backend of your application.

You are right. In general, it is a bad idea to use access token for authentication. We have done multiple presentations to caution developers about it. https://docs.google.com/presentation/d/1klTZheiQIhcty6MKvTYS12cw1Vyn4T1R4d60QCRYM60/edit?usp=drive_web

If there is no other option and one only has an access token, you may be able to do some extra verification to use it to login and mitigate potential security issues. There is a reason ID Token was designed in OpenIDCOnnect and that is to use for authentication.

Answer 2

The recommended way is to use the new Google+ Sign-in: https://developers.google.com/+/mobile/android/sign-in