What's the difference between app access token and user access token?
I noticed that userData from FB is different, but I can make OpenGraph action and post on user wall or send to friends wall.
Can I use app access token in OpenGraph action?
App access_token allows you to make request to the Facebook API on behalf of an App rather than a User. This is useful, for example to:
modify the parameters of your App
create and manage test users
read your application's insights
publish content to Facebook on behalf of a user who has granted a publishing permission to your application
Now in the Open Graph area:
If your app publishes on behalf of its users and requires an access
token with no expiration time, you should use an App Access Token. An
App Access Token is signed using your app secret and will not expire;
it will be invalidated if you re-key/reset your application secret.
App Access Tokens should only be used when the posting functions are
originated directly from your servers in order to keep them private to
the app.
...
App Access Tokens are especially useful when
publishing instances of “secure Open Graph actions”, Open Graph
actions that should only be published by your app, such as
achievements and game scores. In this specific example, a user is
prevented from gaming his/her score by publishing fake
scores/achievements using a user access token.
Please read the following documents:
Login as an App
Using App Access Tokens (Open Graph)
Related
In Firebase, it is possible to log in a user as anonymous with a token, and when the user decides to register, just update the credentials. I have a hard time understanding whether the same is possible with Auth0.
We are now using Auth0 as identity provider, the flow is the following:
The user is using the app anonymously with limited access.
User registers in the app with Auth0.
Auth0 issues a token
Firebase receives the token and lets the user use the restricted parts. All the data generated by the anonymous user is lost
What I want to achieve:
When the user starts using the app, Auth0 immediately creates a user token
The token is valid to access certain parts of Firebase database
If/when the user decides to register, their token remains valid but receives additional credentials
Firebase lets the user use the restricted parts
It's Konrad from Auth0 Community Team. Yep as Baskaro said unfortunately it's not supported from our side of stack. It will be great if you can submit it as a feature request to our product team using our feedback form (you will be contacted by one of our product managers within 10 business days):
https://auth0.com/feedback
Hi generated secret file using OAuth 2.0 client ID. In that secret file, I do not see any google mail address to authenticate or access permissions to that mail address. Still facing below error.
Arg, there was an API error : 403 : User does not have sufficient permissions for this profile.
How come I know, to which user, we do not have sufficient previliges?
Please help me with this
You have created an Oauth2 client for use with your application. When the application runs a user will need to login using their Google account and grant the application (client) access to their data. I have an article that explains how google oauth2 works if you are interested. Oauth2 for beginners
User does not have sufficient permissions for this profile.
Means that the user you have authenticated with does not have access to the Google Analytics profile you are trying to request data form. Try doing an Accountsummires.list this will return a list of the Google Analytics accounts that the current authenticated user has access to and the ones you will be able to request data from.
Question: How come I know, to which user, we do not have sufficient privileges?
You have a profile id you are trying to access find someone who has access to that profile and have them run your application. When they have logged in and authenticated they will be able to see the data.
I have a customized third party server that handles all the rest apis. I am using Meteor as a middleware where the user logs in and accesses all the pages. All the information in those pages is basically generated using my actual web server (built in Symfony).
So using meteor HTTP.post I send user email and password as params, and my website API returns a json with a success or failure message. On successful login, it sends back a token.
What I am not being able to do is to, as according to this success message, "login" the user on my Meteor app without creating/checking Users collection from accounts.
The flow should be: successful login? authenticate the user, consider it as logged in user and store its token in session (without storing anything on this middleware). error? prevent the user from accessing private urls
I have found various packages, but they all target specific third party servers like:
Facebook with accounts-facebook
Google with accounts-google
GitHub with accounts-github
Twitter with accounts-twitter
Meetup with accounts-meetup
Meteor Developer Accounts with accounts-meteor-developer
Can this be done?
I have been using firebase chat and firepad for real time functionality in My Web Application which has multiple pages like a forum.
I started using the Firebase SimpleLogin too.I am able to login as a user and get the auth object which has the uid,id etc info.
1)Now if the user traverses to another page(i.e a new url(same application) is loaded ),does the authentication persist ? Ofcourse as we are manually doing the authentication by calling ref.login(),how can we know if the user is logged in when the second page is loaded.Will firebase store any cookie in user's browser or local storage ?
2)If the user is authenticated through firebase and now for for any request to my backend server for a new page ,how will I know that the user is authenticated.Should I be manually handling this by inserting some cookie in the browser or a hidden form field once firebase login happens ?
3)Is firebase Authentication suitable for multi page web application where the html pages and content are served from a back server other than firebase.?
I have checked the below question too.
Firebase JWT Authentication, Continually Send Token?
As long as browser cookies and local storage are both local storage is available on the browser, Firebase Simple Login sessions will be persisted across page refreshes on the same domain. Simply reinstantiate the Firebase Simple Login client via new FirebaseSimpleLogin(ref, function(error, user) { ... }) to restore a persisted session, if one is available.
Using this approach, your callback will automatically be invoked with the login state of the user. Note that you do not need to call .login(...) again to pick up a session, as calling .login(...) will always try to create a new session.
Once the user is authenticated, you can begin writing Firebase Security Rules, making use of the auth variable, which is non-null for any authenticated user, and will contain useful user information (such as user ids) when using Firebase Simple Login. See the 'After Authenticating' section of any Simple Login auth. provider page to see the exact payload.
In the event that you already have an authentication system you'd like to integrate with Firebase, or Simple Login is not sufficient for your needs, you can always generate Custom Tokens with your own custom data. These tokens can contain any arbitrary JSON payload of your choosing, which will be available in your Firebase security rules under the auth variable.
See the Firebase Security Quickstart for more information.
I am writing a small program to retrieve and display Google Analytics information. I keep getting a 403 Forbidden error because of insufficient permissions.
I read on other posts that you have to add the email address associated with the client id you are using to access analytics in User Management.
The client id I am using however is associated with an installed application and doesn't have an email address, it only lists a client id, client secret, and redirect Urls as credentials in the developer's console.
How can I allow access for this client id when there is no associated email address listed in the developer's console to grant permissions to on the User Management page in Google Analytics?
Simply follow Google's OAuth 2.0 guide for installed applications.
Create a URL for authorization like you would for a web app. Only set redirect_uri to urn:ietf:wg:oauth:2.0:oob.
Point your user to this URL and let him authorize your app. Then the user will receive a code.
Prompt the user to enter this code in your app and use it to retrieve a refresh token from Google.
Store the refresh token and use it to get a fresh access token whenever you need one.