Single-sign-on authentication vs authorization

Question

I'm implementing Facebook and Google SSO on my website using custom workflow (redirect urls, parsing on server side etc. - no javascript) and I got to the point I have access_token, token_type and expires_in and from Google also id_token and I am confused what to do next to authenticate the user. I read a little about authorization vs authentication, and that Facebook and Google SSO is OAuth2 which provides authorization, but not authentication, from which I understand that this way my web application is authorized to do something on behalf of the user, but I cannot be sure the user is the one who I think he is? My main source is this: OAuth Authorization vs Authentication

So, my question is, what should I do to be able to can consider the user logged in.

Thank you

Answer 1

In your case google (and facebook) is authenticators. This services just tells your application that user who try to login to your system is the one who he wants to appear.

Assume you differentiate users by unique email. Your application flow should be next:

1. The user try to login to application using google Application do all redirection google flow stuff and gives you tokens
2. Application need to store this tokens for future use
3. Application check if this user's email presented in database
4. If email is presented and google returns tokens (google authenticate your user successfully) you can login user in your app
5. If email isn't presented in database but google authenticate user successfully you can store this user (with email) to your database - sign it up - this is new user in your system

Same flow with Facebook. Surely you can extend this logic to be more your application specific.