Using OAuth for authentication with CakePHP 2.3

Question

I have a CakePHP app that I'd like my users to be able to use OAuth to log in to.

I seem to have the OAuth conversation working correctly, as I am getting user info out of the end of it, and can save the tokens to my users table fine.

My question is possibly a silly one, but I'm trying to work out when I need to use the token I was given. Should I be storing the user's ID in a cookie, and whenever they 'come back' to my site grab their token from the DB and us it to re-check their details?

I don't get any sort of password for the user with OAuth, so should I just bypass Auth for these people, or use one of the tokens as the password for CakePHP?

---

Here are the login and oauth2callback parts of my UsersController:

<?php
class UsersController extends AppController {

    public function login() {
        if ($this->request->is('post')) {
            if ($this->Auth->login()) {
                $this->redirect($this->Auth->redirect());
            } else {
                $this->Session->setFlash(__('Invalid username or password'));
            }
        } else {
            $client = $this->getGoogleClient();
            $authUrl = $client->createAuthUrl();
            $this->set(array('GoogleAuthUrl' => $authUrl));
        }
    }

    public function oauth2callback() {
        $client = $this->getGoogleClient();

        if (isset($this->request->query['code'])) {
            $client->authenticate($this->request->query['code']);
            $this->Session->write('token', $client->getAccessToken());
            $this->redirect('oauth2callback');
            return;
        }

        if ($this->Session->read('token')) {
            $client->setAccessToken($this->Session->read('token'));
        }

        $accessToken = $client->getAccessToken();
        if ($accessToken) {
            $oauth2  = new Google_Oauth2Service($client);
            $user = $oauth2->userinfo->get();

            $token = json_decode($accessToken);
            debug($token);
            debug($user);
            // We now have a user from Google. Either log them in, or create a new user
            $id = $this->User->field('id', array('email' => $user['email'], 'oauth_id' => $user['id']));
            if (empty($id)) {
                $new_user = $this->User->create();
                $new_user['User']['username'] = $user['email'];
                $new_user['User']['email'] = $user['email'];
                $new_user['User']['oauth_id'] = $user['id'];
                $new_user['User']['oauth_token'] = $token->access_token;
                $new_user['User']['oauth_expires'] = time() + $token->expires_in;
                $new_user['User']['oauth_id_token'] = $token->id_token;
                $new_user['User']['oauth_refresh_token'] = $token->refresh_token;
                $new_user['User']['oauth_created'] = $token->created;
                if ($this->User->save($new_user)) {
                    $new_user['User']['id'] = $this->User->id;
                    debug($new_user);
                    $this->Session->setFlash(__('Registration complete!'));
                    if ($this->Auth->login($new_user)) {
                     //   return $this->redirect($this->Auth->redirectUrl());
                    }
                    //$this->redirect(array('action' => 'index'));
                } else {
                    $this->Session->setFlash(__('There was a problem with your registration. Please, try again.'));
                }

            }

            // The access token may have been updated lazily.
            $this->Session->write('token', $client->getAccessToken());
        }
    }

}

Answer 1

The CakePHP way of adding custom authentication to the Auth component is to create a "Custom Authentication object" (see http://book.cakephp.org).