Ytukyg

I need to develop some backend application using spring boot (the best will be 2.0 but 1.5 is ok too) which will allow oauth login with facebook and google.
I have following requirements:

• backend will enable login with google or facebook (and on first login backend have to remember user in DB),


• backend will publish ONLY rest endpoints,


• frontend will login into facebook or google and then it will send token to backend, backend will validate token in facebook or google (obviously it depends on token provider) and return some json data.

How can i achieve that? I have seen many tutorials but all of them assume that backend and frontend are connected into one application. For some reasons i really don't want that solution: this backend will propably publish data for few applications.
Can you please help me with that? I mean some tutorials, code repo etc...
Thanks in advice

Google and Facebook have provided step by step details to integrate with their login and validate the token with backed.
You can follow the below steps for details.

Google :
https://developers.google.com/identity/sign-in/web/sign-in
https://developers.google.com/identity/sign-in/web/backend-auth

Make a rest call https://www.googleapis.com/oauth2/v3/tokeninfo?id_token= to integrate and validate the token with backed, pass the accessToken which recived on successfully logged in with frontend google web plugin and store the info or validate with your DB.

public String getGoogleTokenInfo(String accessToken) throws BadRequestException {

        log.debug("Calling Google API to get token info");

        RestTemplate restTemplate = new RestTemplate();

        String googleResponse = null;

        try {

            HttpHeaders headers = new HttpHeaders();

            headers.setAccept(Arrays.asList(MediaType.APPLICATION_JSON));



            UriComponentsBuilder uriBuilder = UriComponentsBuilder.fromUriString("https://www.googleapis.com/oauth2/v3/tokeninfo").queryParam("id_token", accessToken);

            log.debug("google login uri {}", uriBuilder.toUriString());

            googleResponse = restTemplate.getForObject(uriBuilder.toUriString(), String.class);

            log.info("Gmail user authenticated successfully, details [{}]", googleResponse.toString());



        } catch (HttpClientErrorException e) {

            log.error("Not able to authenticate from Google");

            try {

                JsonNode error = new ObjectMapper().readValue(e.getResponseBodyAsString(), JsonNode.class);

                log.error(error.toString());

                throw new BadRequestException("Invalid access token");

            } catch (IOException mappingExp) {

                throw new BadRequestException("Invalid user");

            }

        } catch (Exception exp) {

            log.error("User is not authorized to login into system", exp);

            throw new BadRequestException("Invalid user");

        }

        return googleResponse;

    }

Facebook:
https://developers.facebook.com/docs/facebook-login/web#example

Make a rest call https://graph.facebook.com/me?access_token= from backed by passing the accessToken which recived on successfully logged in with facebook frontend web plugin to validate the token and get profile info and store the info to your DB.

public String getFacebookProfileInfo(final String accessToken) throws BadRequestException {

        log.debug("Calling Facebook API to validate and get profile info");

        RestTemplate restTemplate = new RestTemplate();

        String facebook = null;

        // field names which will be retrieved from facebook

        final String fields = "id,email,first_name,last_name";

        try {

            HttpHeaders headers = new HttpHeaders();

            headers.setAccept(Arrays.asList(MediaType.APPLICATION_JSON));



            UriComponentsBuilder uriBuilder = UriComponentsBuilder.fromUriString("https://graph.facebook.com/me")

                    .queryParam("access_token", accessToken).queryParam("fields", fields);



            log.debug("Facebook profile uri {}", uriBuilder.toUriString());

            facebook = restTemplate.getForObject(uriBuilder.toUriString(), String.class);



            log.info("Facebook user authenticated and profile fetched successfully, details [{}]", facebook.toString());

        } catch (HttpClientErrorException e) {

            log.error("Not able to authenticate from Facebook");

            throw new BadRequestException("Invalid access token");

        } catch (Exception exp) {

            log.error("User is not authorized to login into system", exp);

            throw new BadRequestException("Invalid user";

        }

        return facebook;

    }