I have an API that needs user authentication. It is the same way Google authenticates when you use their API to access user data. I really don't want to setup an oauth2 server and I want user to login via OpenId providers (Google, Facebook,...).
Does anyone know if this is possible and secure?
- User access client app which is using my api
- Client request the user to signin
- User is redirected to the api server login page
- User is redirected to the OpenId provider (they choose) and authenticates
- OpenId provider sends the api server a token (TokenA)
- API server send a new token (TokenB) to the client that is linked with the token (TokenA) and provider (facebook, google, ...) in the Database
- When the client requests user data, they must send the new token (TokenB) to the server for verification
If someone has a better way to do this I would love to hear it!!!