4

I'm trying to get OpenID working with OAuth 2 for using Google's API. I only want the user to have to "grant access" once when they login for the first time. Here is the flow I have so far:

  1. User clicks "Login with Google"
  2. My server signs in the User with OpenID. With federated login I receive an OAuth Request Token.

From https://developers.google.com/accounts/docs/OpenID#oauth it says the next step is to exchange the request token for an access token. However, I see a couple problems with this:

  1. It is an OAuth 1 API call.
  2. It requires a verifier. Don't I need the user to "grant access" to receive the verifier? How is this federated?

Thanks for any help!

Brian DiCasa
  • 9,369
  • 18
  • 65
  • 97

1 Answers1

7

You should use OAuth 2.0 based authentication: https://developers.google.com/accounts/docs/OAuth2Login

This is also referred to as OpenID Connect.

This will redirect to your site with an authorization code. You then exchange that for an access token. You can validate the access token by calling the TokenInfo endpoint with a simple REST request. This will give you a simple userid identifier.

After, you make a call to get the detailed profile information, such as name + email, etc.

You can see more about how it works with this great demo: http://oauthssodemo.appspot.com/

Ryan Boyd
  • 2,978
  • 1
  • 21
  • 19