Question

I’d like to allow my users to login to my website using my login system, or FB Connect or Google Login. I wouldn’t want to use big libraries (like dotnetOpenAuth) for only those 2 options – So how should I accomplish this?

Additional question – how should I bind the FB/Google user to my inner user system? I’d like to allow to login using both of them (I could for example login using FB and then login with Google, and still be bound to the same user).

I’m using ASP.NET MVC 2

Thanks!

Answer 1

If you don’t like to use big libraries like DotnetOpenAuth you will have to manually implement the OpenID protocol. Here are the specifications you will need to conform to.

This being said, I would recommend you using an existing library. DotnetOpenAuth is the reference library for .NET.

Also a small remark: OpenId and OAuth are different standards and are designed to achieve different things: OpenId is for authentication while OAuth is for authorization.

As far as identifying the same user which could log from different OpenID providers is concerned you will need something to identify them. For example with DotnetOpenAuth when creating an authentication request to the OpenID provider you could require the FullName and the Email:

using (var openid = new OpenIdRelyingParty())
{
    var request = openid.CreateRequest(Identifier.Parse(openid_identifier));

    request.AddExtension(new ClaimsRequest
    {
        BirthDate = DemandLevel.NoRequest,
        Email = DemandLevel.Require,
        FullName = DemandLevel.Require
    });
}

and use this information to identify the user within your internal database.

So here’s the idea:

1. You create an internal database table which will contain your site users. At the beginning this table is empty.
2. A user comes to your site and wishes to use it. He is not yet authenticated so you ask him for his credentials. You provide him the ability to choose his OpenId provider and prepare an authentication request and redirect him to his provider for authentication.
3. The user authenticates with his provider and is redirected back to your site. At this moment you know his claimed identity and you add the user to your users table. Now the user can always come back to your site and login.
4. You could provide the possibility to your authenticated users to add another OpenId provider (just like StackOverflow does). The important idea is that the user needs to already be authenticated to your site in order to do this. So he could enter his alternative OpenId provider and get redirected to this provider for authentication. Once he authenticates he is redirected back to your site and because he was already authenticated to your site you could add to the users table his alternative OpenId provider.
5. The controller action which will handle the redirect from the OpenId provider should check whether the user is already authenticated to your site and if not authenticate him using FormsAuthentication.GetAuthCookie and passing the claimed identity. If the claimed identity doesn’t exist in your internal users table you need to add it. If the user is already authenticated to your site it means that he is adding an alternative OpenId provider to his profile, so you would update your users table and add the new provider to it.