无需用户名和密码的身份验证

Question

I'm working on an AIR application that connects to facebook. After the user connects to his facebook account he should be able to do stuff to the account linked to the facebook account he's logged into.

Typically, you'd have a login() function that accepts a username and a password, authenticates them and sets a cookie. In my case, all I have after the user logs in to facebook is his facebook user ID, how can I authenticate users based on that?

Thanks,

Answer 1

You're not really doing the authentication any more if your having the user log in via their Facebook account, now Facebook is handling the authentication and you just have to link it to the account that Facebook gives you. That is the whole point as far as I can see.

edit:

Yes, but say i use a function like login(FBuid), how does the backend check that the user is actually logged in with FB and is actually authenticated?

If you have it set up correctly, the API will connect to Facebook and then their scripts will check if that user is already signed in (ie. they have an active session, which is confirmed by a valid facebook session cookie). If they don't have an active session then it will ask them to log into their account and return you the Facebook user Id. If they do have an active session they will just return the Facebook user id to you without asking the user for anything. The Facebook user Id that you receive back is your confirmation that they have been authenticated.