API authentication without Oauth2 server

Question

I have an API that needs user authentication. It is the same way Google authenticates when you use their API to access user data. I really don't want to setup an oauth2 server and I want user to login via OpenId providers (Google, Facebook,...).

Does anyone know if this is possible and secure?

1. User access client app which is using my api
2. Client request the user to signin
3. User is redirected to the api server login page
4. User is redirected to the OpenId provider (they choose) and authenticates
5. OpenId provider sends the api server a token (TokenA)
6. API server send a new token (TokenB) to the client that is linked with the token (TokenA) and provider (facebook, google, ...) in the Database
7. When the client requests user data, they must send the new token (TokenB) to the server for verification

If someone has a better way to do this I would love to hear it!!!

Thanks

Answer 1

Just to be sure we're on the same level: 'oAuth' is not 'OpenID'. 'OpenID' is about authentication (proving who you are), while 'OAuth' is about authorisation (to grant access to things without having to deal with the original authentication). It's 'OAuth' that can be used in external partner sites to allow access to protected data without them having to re-authenticate a user.

To answer your question: I'm wondering that you want to go through the hassle of figuring out alternatives when plenty of simple libraries exist that allow you to implement oauth in a clean and (more important) official way. Instead of thinking you actually have to 'setup your own oauth2 server', you might want to take a look at http://oauth.net/code/ as there's no reason to do that to handle oauth for authorisation as part of your API's user authentication... just use your domain as your OpenID Provider.