How does a user register with Oauth?

Question

I have been doing research on this Oauth concept and I am still very confused about this concept. One of my main questions is how does one register with a google account or a twitter account.

For example, lets say in order to register to my website, you must provide a Username/Password/Email/GroupName. If you register through my website, than you can provide those fields very easily. However let's say the user wants to register through google. How would those fields populate?

From my understanding once you register with your google credentials, you are redirected to a page on my website where you fill in the required fields. I am not sure if this is correct. Can anyone help me understand this more?

Answer 1

Basically OAuth works like this (depending on the version these points consist of multiple steps):

• You redirect the user to a provider, where he logs in
• The user is redirected back to you and you receive an access token

Using this access token you can then request the users data from the provider. Typically the providers provide a call which you can use to ask for the user's email address, full name and a (provider-specific) user id, but that is not part of OAuth.

How you now use this information to handle that user as if he logged in to your site is then completely on your own. You probably want to create a new user object on your side each time you see a new user id.

Answer 2

There are couple of basic concepts that needs some clarity before one can understand how a new user registration happens using OAuth2. These are:

• Resource Owner (You, the human)
• Identity Provider (Google, Facebook, Twitter, etc.)
• Resource Server (Same as Identity provider, or some other service)
• Resources (Things you want access to)
• Client app (The app you are using to access those things)

For new user registration, you will follow the same sequence of client app requesting authorization to be granted access to the resources. This will trigger a login page, user logs in, authorization code is created (by the IdP) and sent back to the client app. The client app exchanges this code for an access token (some encryption signing is involved, read up the documentation - basically allowing client app to prove its own identify).

This access token is then used to request access to resources - in this case, the new user profile. This could be name, email, picture etc. Use this to create a new row in your client apps profile database. A new user account is created.

Then for subsequent logins, the client app will use this access token to validate its life with the Google Auth server - and then create a local session/cookie to login the user.

Hope this is clear.