Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Suppose I run a book club, and each of the members sign into my website using an OAuth token from Google, Twitter, Live, or LinkedIn.

When the book club becomes popular, we discover that 3rd party apps want to read data from our database. We store things like: the list of books each person has read, the queue, and what they thought of each book. The third parties (Amazon, Barnes and Noble, etc) want to read that data, under the context of the logged in user.

Question

  • How should I design the OAuth login scheme for my website?
  • Can I rely on 3rd parties? (Google, twitter, anyone else?)
  • Once logged in, how can I share a subset of my data with 3rd party apps

  • Is the only way I can achieve this is if the IDP (Google or Yahoo) adds support for this (say in OAuth 3)?

share|improve this question
    
Have you been able to find a solution to this problem? It seems I'm getting in the same situation, opening up an api to potential third party developers, but at the same time relying on oauth providers like facebook, google. – Tobias Wormstaedt Apr 1 at 1:46

You rely on OAuth providers to have users share their identity with you. If you want apps to read info from the users from your database, you effectively have to become an OAuth provider yourself. Your apps should only deal with you and your user identities, not any third party providers that your book club uses.

How this would look if a user signs up and wants to use an app:

  • user clicks sign in with Twitter
  • Twitter asks user if it's okay to provide your book club with information
  • you have the link to Twitter and can create an account, read the tweets, whatever
  • your user wants to install an app on the book club
  • they go to the app, the app invokes the same process that you did with Twitter, but with your book club
  • Book club asks user if it's okay to provide app with information
  • user agrees and the app has your book club's user info and access token

What if the app wants to enable third party signin via your book club? Well the user has to click "sign in with book club". If they are not signed in, how do they sign in on book club? Right, by using Twitter, Facebook, etc. Effectively you are chaining different auth providers. But two steps should still be manageable for a user.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.