Facebook Authentication for a Web API service/mobile app

Question

I have an ASP.NET MVC Web Api web service and some mobile applications that use it.

I'm struggling to implement an identity provider and security for my app and web service. Can I use Facebook authentication to manage the identity of my users? Reading through the FB Login documentation, I can't see how ... I'm imagining that I would have the users log in via FB, go through the authentication flow that I choose to implement, and then get back an access token. But what happens next time they open my app? How are they authenticated again, and what do I store in my database that uniquely identifies a Facebook user (and user of my app)? I need their identity in the context of my app, not just to know that Facebook said they were OK.

Since this is a Web Api serving up only JSON (no UI), I prefer not to use any javascript. But the fact that you need to redirect at some point in the flows is a concern to me also, because the mobile app shouldn't redirect during login.

Answer 1

I know it is late... but this might help you.

The Login part has to be done in the client (WebForm, MVC, Desktop, Mobile, etc)... the client will open a webbrowser (it could be integrated in your app) allow the user to login and give the correct permissions to your app.

Facebook will return an AccessToken to you which will be only valid for a limited time, but you can request an Extention.

Since you want to create a Web Service, your service will have to receive the AccessToken from the client and then you can do whatever you want then it. (Including extending it)

FYI: This post talks about trying to use oauth without a browser.

FB Login Documentation

Hope it helps, Daniel.