简体繁体 English

关于facebook单点登录的问题来自我的iOS应用程序

[英]Question about facebook single sign on from my iOS app

原文 2011-01-27 03:02:41 1 1 iphone/ ios4/ facebook/ single-sign-on

I'm writing an iPhone app that needs a server based component, and rather than make the user create a new account just for my app, I thought I'd make their life easier by having them log in with their facebook account. 我正在编写一个需要基于服务器的组件的iPhone应用程序，而不是让用户只为我的应用程序创建一个新帐户，我想我可以通过他们的Facebook帐户登录来让他们的生活更轻松。 I don't plan on using the Facebook Connect API very much, I just figured that nobody wants to remember an extra password if they don't have to. 我不打算非常使用Facebook Connect API，我只是觉得没有人想要忘记额外的密码。

The problem is that I don't think I really understand how to do my server side authentication correctly. 问题是我不认为我真的理解如何正确地进行服务器端身份验证。 Here's how I'm doing it now: 我现在就是这样做的：

1) The iphone client app brings up a UIWebView pointed at https://graph.facebook.com/oauth/authorize??client_id=<my_client_id>&redirect_uri=<my_redirect_uri>&... 1）iphone客户端应用程序显示指向https://graph.facebook.com/oauth/authorize??client_id=<my_client_id>&redirect_uri=<my_redirect_uri>&...的UIWebView https://graph.facebook.com/oauth/authorize??client_id=<my_client_id>&redirect_uri=<my_redirect_uri>&...

2) The user logs in to facebook. 2）用户登录Facebook。

3) The UIWebView gets redirected to my server with the OAuth access token as a parameter. 3）使用OAuth访问令牌作为参数，UIWebView被重定向到我的服务器。 I intercept this in the iphone client app and do the request as an NSURLRequest to capture my server's response. 我在iphone客户端应用程序中拦截它并以NSURLRequest的形式执行请求以捕获我的服务器响应。

4) My server gets this request, stashes away the OAuth token, uses it to grab the user's facebook id, stashes that away, and sends back to the iphone client app the facebook user id and a randomly generated password. 4）我的服务器获取此请求，隐藏OAuth令牌，使用它来获取用户的Facebook ID，将其藏匿，然后将用户ID和随机生成的密码发送回iphone客户端应用程序。

5) From here on in, the iphone client app only talks to my server over HTTPS (never again to facebook), using users_facebook_id/randomly_generated_password as the credentials. 5）从这里开始，iphone客户端应用程序只通过HTTPS（再也不是facebook）与我的服务器通信，使用users_facebook_id / random_generated_password作为凭证。

I have two questions. 我有两个问题。

1) It feels like I don't have the right solution here. 1）感觉我在这里没有正确的解决方案。 Is there a standard, best-practices way to do this type of thing? 有没有一种标准的，最佳实践的方法来做这种事情？ (ie use facebook credentials to log into your own server from your own iPhone client) Can anyone link me to an explanation or a tutorial? （即使用facebook凭据从您自己的iPhone客户端登录您自己的服务器）任何人都可以链接到解释或教程吗？

2) I saw the facebook ios sdk and that seems much slicker than what I'm doing right now. 2）我看到了facebook ios sdk ，这看起来比我现在正在做的更加光滑。 Can that do the types of things I need here? 这可以做我需要的东西吗？

Thanks for the help! 谢谢您的帮助！