The Facebook authenticator provides the ability for users to login using Facebook. The integration to Facebook is done using OAuth 2. To use it, you need to configure a OAuth 2 client in Facebook, and then configure a Facebook authenticator instance in the Authentication Service. The steps to do this are described below.
To use Facebook accounts in the Authentication Service, you need to register a Facebook app. To do this, sign into Facebook, register as a developer, and create a new new app at https://developers.facebook.com/.
After logging into Facebook for Developer, click on My Apps in the top navigation bar. Then click Create App.
Fig. 67 Facebook - Start screen
In the Create an App screen, select an App Type, for example None. Then click Next
Fig. 68 Facebook - Select App Type
Then, enter a Display name (e.g., CurityLogin) and an App contact email, then click the Create app button.
Fig. 69 Facebook - Create new Facebook app
In the panel to the left, select Setting -> Basic. Facebook has generated credentials for the authenticator. The App ID in Facebook will correspond to the client_id in the Authentication Service, and Facebook’s App secret will be used as the client_secret. To access this secret key, click the Show button.
Fig. 70 Facebook - App ID and App Secret
The redirect URI is the URI where Facebook will redirect the user when the authentication is done. The URI that the Authentication Service uses is generated automatically based on configuration, and is the path to the authenticator with an added /callback. This last part of the path is only used in the communication between the Authentication Service and Facebook, and can not be changed whereas the preceding components of the path can be.
The form is like this:
<base-url>/<authentication-endpoint>/<authenticator-id>/callback
For example, for a server running on server1.local and a protocol of https and listening on port 8443 and having an authentication endpoint configured to be /authn/authentication and with a Facebook authenticator instance called facebook1, the redirect URI would be:
https://server1.local:8443/authn/authentication/facebook1/callback
This redirect URI needs to be set in Facebook. To do so, find that app that you previously created (e.g., CurityLogin), and click Facebook Login -> Settings in the panel on the left .
In the Valid OAuth Redirect URIs section, add the redirect URI(s).
Important
Press enter in order for the redirect URI to be added to the field.
Fig. 71 Facebook - Redirect URI
Finally, click Save Changes.
The App is now registered and can be used in the Authentication Service.
The general authenticator configuration is described under Authenticator Base Configuration. This section describes the additional parameters that are available for the Facebook authenticator.
Authenticator base is /profiles/profile{id type}/settings/authentication-service/authenticators/
List Entry: <authenticator_base>/authenticator/ (key id)
type string
mandatory
default public_profile email
public_profile email
default https://www.facebook.com/dialog/oauth
https://www.facebook.com/dialog/oauth
default https://graph.facebook.com/v2.3/oauth/access_token
https://graph.facebook.com/v2.3/oauth/access_token
default https://graph.facebook.com/v2.2/me
https://graph.facebook.com/v2.2/me
Example:
<authenticator xmlns="https://curity.se/ns/conf/profile/authentication"> <id>facebook1</id> <facebook xmlns="https://curity.se/ns/conf/authenticators/facebook"> <client-secret>123456778912345677890012345677890</client-secret> <client-id>1234567890</client-id> </facebook> </authenticator>