I have a REST web service which already implements oauth authentication mechanism via browser.
I would to expose my API to a number of mobile clients programmed by third parties. In this scenario 4 actors are involved:
- My Web application A
- The authentication Provider P (e.g Facebook/Google/Twitter/etc)
- The mobile application client C (made by a third party developer X)
- The End User U
I read a lot about two legged and three legged authentication with Oauth2 but I understood that none of the two are feasible solutions.
The former because involves only C and P.
The latter because involves A, P and U (i.e. A and C are products of the same developer).
For the client authentication I actually handle the situation generating a couple of keys for the developer of the client C asking to authenticate his apps against my service A and sign each requests. My question is: Since my application is naturally registered on developers.facebook.com and my keys are stored in the web server, how can the third party developer use my API and authenticate the final user? Must he register his mobile app C on facebook and share his access token with my web app A?