Solved

Forms Authenticaition and Connect using Facebook or Twitter

Posted on 2010-11-09
4
673 Views
Last Modified: 2012-05-10
Hey all,

We are developing a website that has standard forms authentication access to the underlying member system - nothing out of ordinary here!

How do we now integrate connecting using Facebook and/or Twitter?
Does anyone have experience with this and can point us in right direction.

We are just not sure what you do after you authenticate with Facebook/Twitter REST API - how do you assign forms authentication ticket?
Do you have to store the Facebook and Twitter details against the user account?

Would love to hear any commentary on this - much appreciated!

Thanks for your time.

Cheers.
Steve
0
Comment
Question by:smacca
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
4 Comments
 
LVL 5

Expert Comment

by:VincentSG
ID: 34099904
Hi!

I assume you know how to authenticate with Facebook and Twitter using their respective API.

After you have authenticated the user, you can set your own cookie using

FormsAuthentication.RedirectFromLoginPage(facebookUserId, IsPersistent); // redirect to default logged in page

or

FormsAuthentication.SetAuthCookie(facebookUserId, false); // If you do not need to redirect to another page

More information can be seen here:
1) http://msdn.microsoft.com/en-us/library/ka5ffkce(v=VS.90).aspx
2) http://msdn.microsoft.com/en-us/library/system.web.security.formsauthentication.setauthcookie(v=VS.90).aspx
3) http://msdn.microsoft.com/en-us/library/ff647070.aspx
0
 

Author Comment

by:smacca
ID: 34100649
Hi,

Thanks for the great examples and comments.

You have given fantastic direction but we are unsure of how the Facebook username associates with the underlying authentication module.
Normally, we would:

  1. Pass username to .net forms authentication (as with your example)
  2. Use the Application Authentication events to check the user details and assign roles to the Principal.

However, when you use Facebook and/or Twitter authentication, these details have no relation to our underlying system (e.g. roles - admin, user, guest).
So, do we:

  1. Have user login to the members area.
  2. Have them authenticate with Facebook/Twitter and then STORE their details against their member information (account).
  3. Then, when they return and sign-in with Facebook/Twitter we simply LOOKUP member account information using the Facebook/Twitter ID.
  4. Then, get their native username and authenticate as you would normally (as well as reassigning userid to the native one for identity, principal and context)


Hope this makes sense as I would really love to get on top of this algorithm.

Thanks kindly for your time.

Steve

 
0
 
LVL 5

Accepted Solution

by:
VincentSG earned 500 total points
ID: 34101425
Hi Steve,

If you want to authenticate the users with Facebook / Twitter directly (as in do not need to register with your site) , I would suggest:

1) Redirect to Facebook / Twitter login using their respective API. Once login is successful, then they will return a token, which I think is a GUID or user name, anyway you can treat it as a string.

2) Check the token with your database. If found, then proceed as usual. You should already have this user's profile in your database - whether he is a member or administrator.

3) Else you can go through the "Registration", for example, creating the entry in your own database and if necessary, ask the user a few questions to determine the type of user he is, for example, ask him to enter a code to prove he is admin or ask him to pay to access the premium section. This part is really your application design.


I hope this helps. Let me know if you need further explanation.


Best regards,
Vincent
0
 

Author Closing Comment

by:smacca
ID: 34105295
Great feedback. Thanks.
0

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Problem Hi all,    While many today have fast Internet connection, there are many still who do not, or are connecting through devices with a slower connect, so light web pages and fast load times are still popular.    If your ASP.NET page …
This article aims to explain the working of CircularLogArchiver. This tool was designed to solve the buildup of log file in cases where systems do not support circular logging or where circular logging is not enabled
In this video you will find out how to export Office 365 mailboxes using the built in eDiscovery tool. Bear in mind that although this method might be useful in some cases, using PST files as Office 365 backup is troublesome in a long run (more on t…
Sometimes it takes a new vantage point, apart from our everyday security practices, to truly see our Active Directory (AD) vulnerabilities. We get used to implementing the same techniques and checking the same areas for a breach. This pattern can re…
Suggested Courses

632 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question