how can I authenticate a user from a web app to an API?

Question

It seems to be a widely asked questions and after having read tons of documentations on the subject, I'm still not sure to have understood everything correctly (I assume that being dumb is a possible answer ;)).

I'm trying to build an API that will provide a service to users. The users will be connected through Facebook or any OpenId provider (I separate Facebook since their implement their own connecting system).

(I think it's a good way because I will not store the user's password and finally will have less problem in case of a similar Gawker issue.)

When a request is made from the client (web app, mobile app, whatever) to the API, an indicator must be sent with the request in order to identify which user is using the app. This is generally used via a token, defined during the Authentication.

But regarding the Authentication, I can't find any valuable example, tutorial, explanations about how to implement it correctly.

I'll (try to) explain :

In my (wonderful world of happy care bears), I structured my project in various parts :

• A RESTful API
• A web apps that will use the api. Ideally, I was thinking about making a complete html/css/js project, without any server side work (php/python/java or whatever)
• A mobile application
• An windows/mac/linux application

As far as I saw, every time someone ask how to implement a RESTful API authentication, three major answers pops out :

• The HTTP basic( + preferably SSL)/digest way
• OAuth
• OpenId

Since I will not store the user's password, the first one is out for me, but the two other leave me perplex.

But OAuth and OpenId are not the sames, one (OpenId) stand for the Authentication (that the base of the questions) where the second (OAuth) stand for the Authorization!

When Twitter implements OAuth for their API, they are not implementing an Authentication system, there are setting up a way to indicate their users that the application X want to have access to the user account (in various level of access). If the user is not currently logged in Twitter, he will first have to authenticate himself, and then authorize the current application to access his data.

So, just to clear things up, OAuth is NOT an authentication mechanism, it's a :

An open protocol to allow secure API authorization (source: http://oauth.net/)

Then, the only way to authenticate a user would be using OpenId. And then, the hell comes true.

If I take as an example a web application that is exclusively made of html/css/js, with no server side components, communicate with an API.

The web app must indicate to the API that the user currently using the API is mister X.

To do so, the web app show a popup containing a list of OpenId providers, asking the user to authenticate himself. The user click on one of them, get redirected (or a new popup open up) to the OpenId provider, indicate his login/pass, get authenticated by the OpenId provider, that return the success with a token (I simplified the communication).

That's great, the web app know now that the user is really mister X. But the API still have any clue !

Finally, my question is quite simple : how can I authenticate mister x through the web app to the API via OpenId and after that, how can the web app and the api keep the information that this is mister X that is currently using the web app and of course, the API.

Thank you very much for your help !

-edited format

Answer 1

You don't really want to login to the API using OpenID. As you said, OpenID is for Authentication, i.e. Who, while OAuth is for Authorization, i.e. am I allowed? But your structure suggest you'll be using an API as a backend and a web app as a front-end.

The best way then is to use OpenID on the web-app to authenticate the user, and then the web-app connects to the API and stores the OpenID credentials. The web-app then knows who the user is, and can provide the service. The API has nothing to do with the user, except that it stores its data.

The fundamental difference between OpenID and OAuth is its use. In your situation, you could have something like that:

--------          ---------            -------
| User | <------> |  App  | <--------> | API |
--------  OpenID  ---------   (OAuth)  -------

The User never interacts directly with the API: who would want to manually send HTTP request? (lol) Instead, the service is provided through the app, which can optionally be authorized using OAuth. However, in the case of a single app accessing the API, you can make the app <=> API connection internal and never expose it.