Question

I want to implement something similar to what Digg has done.

When the user logs in for the first time, I want it to force them to create an account on my site.

More importantly I want to know how to log a user into my site when they login with facebook connect. If they login with facebook connect, they still haven’t provided me the password to their account on my site, so I can’t use username/password to log them into my site. How do they do this on Digg or sites similar to this?

Answer 1

Facebook’s process flow can definitely be a bit confusing. Take a step back from the details and the API, and look at the overall flow here:

Facebook Connect will tell you that a user is logged into Facebook, and give you their Facebook ID. You can validate that ID against Facebook using Facebook Connect to make sure it is properly logged in. Once this is done, you don’t need a user name and password. As long as you trust that Facebook has authenticated the person properly, they are the only ones that can come to your site using that Facebook ID. That is enough information to start an authenticated session based around a local account that is associated with that ID.

The process you should follow is like this:

1. User logs in to your site with
   Facebook Connect for the first time
   • You notice that you don’t have a local account associated with that
     Facebook ID, and prompt them to
     enter local account information
   • You save that information along with their Facebook ID
   • The next time you see that Facebook ID (and validate that it is
     logged into Facebook using the
     Facebook API), you can start up a
     local session using the associated
     account.

Basically you end up with two separate methods of authentication: a Facebook Connect ID check, or the regular username/password login on your site. Either one should have the end result of starting a local authenticated session.

Hope that helps.