Question

Background:

• MySite.com – my website
• ParentSite.com – website of a client
  company (which will have OAUth
  provider module on it)
• MySite Module – a module which I have created which will be installed on ParentSite.com
  and which will allow users of
  ParentSite to be redirected to MySite (via
  OAuth). I have full control over what
  I do in this module. I will be displaying links that users will be clicking on and expecting to reach MySite and be fully logged-in.

My understanding of a standard OAuth setup:

1. Users go to a specific URL on MySite.com for OAuth login into ParentSite.com.

2. The MySite app retrieves an OAuth “request token” from the ParentSite.

3. The browser is redirected to the ParentSite.com site, asking to confirm that the MySite App is allowed to see the user’s information.

4. The user confirms. (*)

5. The browser is redirected to the MySite.com, which now has an OAuth “access token” for the user.

6. The Client App sends a REST request back to ParentSite.com, using the OAuth access token from step 5 as authentication, requesting the user’s identity information (e.g. ParentSite user ID, name, email address).

7. The ParentSite validates the OAuth access token and returns the user’s information to the Client App.

---

My scenario is slightly different, the differences are:

A. The users are users of ParentSite.com and are at ParentSite.com and need to be seamlessly connected to MySite.com when they click on certain links on “MySite Module”

B. I would like the user-authorization step (step 3 and 4) to be automated, ie, no prompting of the user.

---

Q1: What do I have to do at “MySite Module” to enable all this? (detailed answer needed please!)

Q2: How can I automate step 3 and 4?

Answer 1

Ok, let me get this straight. Clicking on something in “parentsite” opens something on “mysite”, “mysite” then tries to manipulate stuff at “parentsite” and therefore needs to be authorized to do so? If I am wrong, please disregard this answer.

I am also assuming that you have control over parentsite.com – otherwise I can not see a way for you to accomplish what you seem to need.

Part 1.

First of all, mysite needs a consumer key and secret.

Part 2.

Since calls to mysite are issued directly from parentsite, you can issue an access token directly within the parentsite service (you already know which user is logged in). So when accessing mysite.com – simply send it the access token and secret it needs.

Part 3.

Ok, so now mysite.com should have consumer key/secret and access key/secret and should be able to do stuff with parentsite.com.

Keep in mind that this really is outside the oAuth specification, but perfectly doable.