Hybrid Authentication - Talking to major

social networks

Md. Rayhan Chowdhury

You have developed a Wow application. & You re sure

everybody will like it.

phpXperts 2011

Md. Rayhan Chowdhury | ray@raynux.com

!lease

Register to taste our WOW Service"

Okey# cool#

will try later...

phpXperts 2011

Md. Rayhan Chowdhury | ray@raynux.com

How can you avoid this boring

registration"

phpXperts 2011

Md. Rayhan Chowdhury | ray@raynux.com

Hybrid Authentication
Login with Facebook

Login with Google Account

Login with Windows Live $ser

phpXperts 2011

Md. Rayhan Chowdhury | ray@raynux.com

It has Benefits too

Hassle %ree login&registration More website users 'uccess%ul (usiness More

money
You

phpXperts 2011

Md. Rayhan Chowdhury | ray@raynux.com

here is also a bonus!

You have access to user s social data# friend base

phpXperts 2011

Md. Rayhan Chowdhury | ray@raynux.com

Cool) (ut ....

Isn"t it too co#ple$% Is there any standard% How to i#ple#ent%

phpXperts 2011

Md. Rayhan Chowdhury | ray@raynux.com

Yes# there is a standard and its so si#ple with

*Auth +.,

phpXperts 2011

Md. Rayhan Chowdhury | ray@raynux.com

"

-hat is *Auth"

'tands %or *.en Authori/ation

(e%ore *Auth0
1oogle Auth'ub# A*2 *.enAuth# Yahoo ((Auth# 3lickr A!4# Ama/on -eb 'ervices A!4# 3acebookAuth

3irst introduced in +,,5 6esigned %or A!4 access delegation

phpXperts 2011

Md. Rayhan Chowdhury | ray@raynux.com

10

OAuth &.'

7e8t evolution o% OAuth (.' 9asy to im.lement More %lows to su..ort desktop and #obile and living roo# devices 7ot backward com.atible with *Auth :.,

phpXperts 2011

Md. Rayhan Chowdhury | ray@raynux.com

11

OAuth &.' %lows are

$ser;Agent 3low -eb 'erver 3low 6evice 3low $sername and !assword 3low Client Credentials 3low Assertion 3low

phpXperts 2011

Md. Rayhan Chowdhury | ray@raynux.com

12

How does OAuth &.' work"

Google
Authorization Re!uest Authorization Code

Resource Owner

Re!uest Access "oken

(Your website)

Client

Access Token

Authorization erver

Access "oken #rotected Resource

Resource erver

phpXperts 2011

Md. Rayhan Chowdhury | ray@raynux.com

13

How to i#ple#ent"

phpXperts 2011

Md. Rayhan Chowdhury | ray@raynux.com

14

Con%igure *Auth+Consumer class

File$ con%ig&'h'
OAuth2Consumer::getInstance('Facebook', array( 'client_id' 'redirect_uri' 'scope' 'base_uri' 'authorize_uri' 'access_token_uri' )); => 'your-client-id', => 'http://yoursite/callback.php', => 'email,read_stream', => 'https://graph.facebook.com/', => =>
'https://graph.facebook.com/oauth/authorize', 'https://graph.facebook.com/oauth/access_token',

'client_secret' => 'your-client-secret',

phpXperts 2011

Md. Rayhan Chowdhury | ray@raynux.com

15

1et user authori/ation

te' (

File$ connect&'h'

Oauth2Consumer::getInstance('Facebook')->authorize();

phpXperts 2011

Md. Rayhan Chowdhury | ray@raynux.com

16

Redirect to *Auth +., end .oint

phpXperts 2011

Md. Rayhan Chowdhury | ray@raynux.com

1rab the Access Token

File$ callback&'h'

te' )

$oauth2 = Oauth2Consumer::getInstance('Facebook'); $accessToken = $oauth2->getAccessToken();

'ave this access token

phpXperts 2011

Md. Rayhan Chowdhury | ray@raynux.com

1!

$se the A!4 with Access Token

te' *

'et the access token

$oauth = Oauth2Consumer::getInstance('Facebook'); $oauth->setVariable('access_token', $accessToken);

$se the A!4 as much as you want

$profile = $oauth->api('me'); $friends = $oauth->api('me/friendlists'); $albums = $oauth->api('me/albums');

phpXperts 2011

Md. Rayhan Chowdhury | ray@raynux.com

1"

6ecide to 2ogin or Register

$ser is new" create an account %irst *therwise# log him&her in to your a.. kee. users and connections table se.arate
)sers ( n *onnections

phpXperts 2011

Md. Rayhan Chowdhury | ray@raynux.com

20

'ociali/e +our Application

9ncourage user to add more connections You have read&write access# so

9ngage more Res.ect user s o.inion

Remember) never misuse

phpXperts 2011

Md. Rayhan Chowdhury | ray@raynux.com

21

-ho 'u..ort OAuth &.'

phpXperts 2011

Md. Rayhan Chowdhury | ray@raynux.com

22

Re%erences
Google API: Documentation: http://code.google.com/apis/accounts/docs/OAuth2.html API Console: https://code.google.com/apis/console/b/0/ Facebook: API Console: https://developers.faceboo .com/apps Documentation: https://developers.faceboo .com/docs/authentication/ Windows Live: API Console: https://manage.dev.live.com/ Documentation: http://msdn.microsoft.com/en!us/librar"/hh2#$%#&.asp' OAuth 2.0: http://tools.ietf.org/html/draft!ietf!oauth!v2!22 http://oauth.net/2/ Oauth2Consu e! Class " #$a %le: http://ra"nu'.com/ra"/labs/pro(ects/oauth2.)ip

phpXperts 2011

Md. Rayhan Chowdhury | ray@raynux.com

23

<uestion and Answer

"
Thank you
phpXperts 2011 Md. Rayhan Chowdhury | ray@raynux.com 24

ource

+,ages are taken %ro, flickr.com

phpXperts 2011

Md. Rayhan Chowdhury | ray@raynux.com

25