在Android上对用户进行身份验证，但在远程服务器上进行处理？

Question

I'm suppose to develop a new option for our Android app that allows new users to sign in with their Google account. We need to retrieve basic user info (First name, Last name, Date of birth, Email, Country etc.) and store them on server. It should happen only the first time user logs in to the app so the next time all the button is doing is simple authentication to access the member's area.

Currently, our app prompt for permission using oauth2 and AccountManager and can retrieve the user info through oauth2 api . I would like to do the same thing on our server instead.

So to sum it up here is the flow I'm thinking about:

1. User chooses to sign in with Google
2. If he hasn't authorized the app yet, request permission to access his info; retrieve and store them on the server and log in. If he has already authorize the app, simply log in.

We still need a local copy of user info on his android device though so he can view his own profile.

Note: The reason I'm thinking of doing the data import process on our server is to speed up the app and save some bandwidth. but I also feel that user might want to modify his data before they get saved to the server.

I'm really confused and the oauth2 documentation doesn't help much.

Answer 1

I don´t understand the problem. Sorry.

Just retrieve information about the customer from the OAuth api, send the information through HTTP/HTTPS post request to the server, save it there. Then save the same information in the SQLite database in phone and after first time when the app launches just check the user table in SQLite for if the customer exists.

Here is an awesome example: http://www.androidhive.info/2012/01/android-login-and-registration-with-php-mysql-and-sqlite/

Answer 2

In order to do this, you need to follow the documentation for Cross-Platform single sign-on and Cross-client Auth from Google. In essence, your flow should be:

1. Check to see if the user is authenticated (probably best as a POST to your remote system), if so, continue to your main activity. If not, show the sign on button.
2. Once the user clicks sign-on, connect the GoogleApiClient, retrieve the current person, save their information on the device (if needed).
3. Request an auth token for the user via GoogleAuthUtil.getToken .
4. Send the token to your web server (must be https). On your web server, retrieve the user's information from the token, and save it to the database.

Also, I suggest you use a persistent cookie store for your requests (I prefer loop4j's Android Async-HttpClient ). This will allow you to save the session easily, so you do not have to authenticate too often.