Take the 2-minute tour ×

I am using Facebook authentication to prove my client software (iOS native) is acting on behalf of a certain FB user. But, how can my client then prove this to my server, which has it's own logon scheme. I guess it needs to pass the FB access_token to my server, so my server can query Facebook to get the user identity?

Or, is there a way to get Facebook to store my own access credentials (username + password for my existing registration system)? So, after Facebook logon, my client would fetch it's username and password from Facebook and use that to logon to my system?

share|improve this question
The idea behind openid is that your user is redirected from your app to Facebook (or the openid host/endpoint) where the user then authenticates and is redirected back to your app with a token. You should then store that token and associate it with the user record. Remember, all your app is doing is asking Facebook if the user is known to Facebook. Your app doesn't need a password, just a response from FB that the user is who he/she says she is. I added this as a comment because I'm not familiar with the details of iOS, just the concepts of openid. Hope this helps. –  jmort253 May 15 '12 at 5:25
Thanks jmort. My app running on iOS knows who the FB user is, but it needs to prove that to my server. That's what I want the password for, to authenticate my client to my server. The alternative is to pass the access_token to my server, so it can also query FB to get the userid. But, this requires a secure client-server communication channel, and then 2 FB queries on the server. One to make sure the access_token is for my app and a second to see what user it is associated with. Apparently, some apps are skipping that 1st query, which makes the authentication meaningless. –  user1055568 May 16 '12 at 4:39

2 Answers 2

OK, here is my pragmatic solution to the same problem.

You authenticate your iOSApp with facebook. This gives you an access_token and you can then get the user's facebook id (fb_id) from facebook.

You now want to use this authentication to authenticate a request to some service related to iOSApp (yourService).

Send the fb_id and access_token with your request to yourService securely (e.g. with https).

yourService then uses the fb_id and access_token to make an arbitrary social graph call, for example:


This call will return an appropriate error if the access_token is invalid or does not match the fb_id so yourService can now fulfil or deny the request on the basis of the return value.

yourService and iOSApp can read or modify the FB graph according to the permissions and status of access_token but the above is all you need if you are just looking to authenticate the user with yourService when they've already authenticated with your iOSApp.

There could be some issues with FB policy regarding the transfer of the access_token but as long as you use https for the transfer it is as secure as the exchange between iOSApp and Facebook.

share|improve this answer
If your service is using this method, what is to stop my service from collecting access_tokens from my users and using them to impersonate those users on your service? –  user1055568 Sep 14 '12 at 0:22

What I ended up doing is to having my server send the client a random logon password via a Facebook app request. I.e., iOS client sends fb_id to my server, my server generates random password and posts it as Facebook app_request. Client fetches app_request from Facebook and uses password to authenticate itself to my server.

share|improve this answer

Your Answer


