How to authenticate a user in an android app that uses Facebook login

Question

I’m creating an Android app where the user will have to register to have access to the application content (a login). For this, I use by default the famous Facebook Login. When the user logs through the Facebook button, I call my REST service that will register it in the remote database. That’s where my doubts arise:

• In my remote database, I currently have the fields username, email and password. Since I’m using Facebook Login (Oauth), what would be the correct/expected/default way to do this?

• Even using facebook login, it is good practice after successful Facebook login I call an Activity for the user to fill username and senha? Does it make sense? Or as the facebook login has already done the hard part of authenticating the user, I just need to have the field email in my database?

I’m a little lost on that and I’d like some guidance from you.

Answer 1

Hello,

I’m setting up a database similar to what you want, the only difference is that in my application, the user will be able to log in both by Facebook, by Google or by my app’s own authentication system, and if the accounts (Facebook, Google, my App) belong to the same owner (detected via email), so they will have the same single user in the application. I am modeling the database to support, regardless of how many authentication means I will use.

In my case, a same user can have 2 accounts, ex: Facebook, Google. Or even 3 accounts, ex: Facebook, Google, My App.

Explaining how it works: Each user "user" can have one or more "Identity", "Identity" is a connection medium used by the user. In the "Identity" table, there is the "user_id" column that points to the user, the "Adapter" column indicates which medium is used (facebook,google,meu_app), and in "hash", the user ID is stored that is returned by Facebook or Google when using their Apis. In case it is an access by the login system of your application (meu_app), then the hash will store the password that it registered, encrypted with bcrypt, in my case.

At the time of login, you must purchase the access email, either by your application (inserted by your login system), or by Facebook or Google, their own API returns the email as well. So, in the login logic of your REST service, you should check if this email already exists in the "user" table, because if it is, it means that the user already exists, right? In this case you will get the ID of this user will check if there is also an "Identity" for the used connection medium. For this check if the "Adapter" matches, if it matches well, check that the "hash" also matches, if it matches, cool! It means that the user already has an account, and has already logged in using that medium. If you do not have this "Identity", then you must register. The same is true if the user does not exist, then you will have to register both the user and the "Identity itself".

Editing: I talked and talked and I don’t think I answered your main questions. So here goes:

For the first question, I think what I wrote above answers. I put an image too.

For the second question, I see no need to make the user fill in username and password, in fact it does not make sense, considering that if the user chose to login through Facebook, it is because he does not want to keep creating username and password. In addition, this whole login process is done in a secure Facebook environment, the API takes care of all this, you only need to take care of the part of storing the user in the BD if the connection is successful. What might be interesting to do, is a step to finalize the registration, if you want to know some additional information that is not returned by Facebook.

Any questions or suggestions, I’ll be following!

Answer 2

THE BASICS FOR AN IMPLEMENTATION:

• Facebook App - Configure, create a simple login link.
• Facebook SDK - Set up the SDK to use the api.
• Facebook App ID - Use your app ID:

1 - Abra res/values/strings.xml

2 - Add a new string with the name facebook_app_id and put your id on it.

3 - Abra Androidmanifest.xml and add that:

<uses-permission android:name="android.permission.INTERNET"/>

4 - Add a meta-data element to the application:

<application android:label="@string/app_name" ...>
    ...
    <meta-data android:name="com.facebook.sdk.ApplicationId" android:value="@string/facebook_app_id"/>
    ...
</application>

5 - To use Facebook Login or Share, just add Facebookactivity to your manifest:

<activity android:name="com.facebook.FacebookActivity"
          android:configChanges=
                 "keyboard|keyboardHidden|screenLayout|screenSize|orientation"
          android:theme="@android:style/Theme.Translucent.NoTitleBar"
          android:label="@string/app_name" />

ANSWERING YOUR QUESTIONS:

To interact with Mysql database, we need to build an API first. The job of the API is to make the client’s request, interact with database and finally give the answer back to the client.

methods GET / POST Interacting with database by entering / data search. Finally will answer back in JSON format

Tutorial

Source