We are creating a service (backend + iOS-app for now) where a user can log in. We have completed our own custom token-based login system with registration. We are now trying to implement the function where they can select to "Log in via Facebook" or "Twitter" etc. (I.E not using our custom registration with username and password)
We have successfully implemented the client-function, but all we receive from the 3rd party service (Facebook) is a token, and the user's basic information.
To use our service, it is (of course) required to have a proper CustomUser-object (our own) registered on our server, which generally would be created on our custom registration. When logging in through 3rd party service, how should we create a CustomUser-object for that externally authenticated user?
When the user is authenticated by a 3rd-party service through our application, how and what do we send to our own server to register (or authenticate)? We receive an auth-token (which will eventually expire), and the app (client) has access to the user's basic information on the 3rd party. We were thinking of sending the basic information, such as the user's user_id and email along with the token, up to our own server and create a new user-object for it if it didn't exist before. However, we realized that this wouldn't be very secure at all. When the user logs in to our service the next time, using the same 3rd party authentication, we only have the users user_id and email to match. The token might be a new token. Which means that anyone intercepting any 3rd-party login-calls to our server will see that the only information needed to log in to an existing customUser based on a 3rd-party authentication is the user_id and an email. Which are very public on most such 3rd-party services, such as Facebook.
We've been trying to read up on OAuth and authorization/authentication using these 3rd-party services, but every single documentation we've seen is painfully focused on the 3rd-party authentication and doesn't touch the subject of our own authentication of the 3rd-party authentication..
Are we going about this all wrong?
