Login to my own webapplication with another website's credentials(eg: login with google)

Question

I have developed a web application (spring mvc, spring security) which has a its own login.

Now I want to change the application to login with an another web site's (2nd web) credentials and also need to get some user details from 2nd website.eg: username, user role list for create authentication object.

Please help me to choose best way to do this.

Is openID or oauth2 better for my client application?

Answer 1

OpenID and oAuth are 2 different things.

Lately, Google announced it stops supporting OpenID, so maybe oAuth2.0 is a better option for you.

Note that if you choose oAuth of 3rd-party, you force your users to have account there. for example, if your application (the resource server) uses Facebook for authentication/authorization, your users will HAVE TO have account on Facebook (you want that?!).

If you work with OpenID, your users have several options of where to hold their account...

If you have another 3rd party (or in-house, it does not really matter) authentication server and you want to authenticate your users with it - you have to know what specifications it supports. For example, if it supports oAuth2.0, you can pretty easily configure your app to work with it.

Hope that helps...

Answer 2

If I understand you correctly, you are talking about using Social Networks like Google+, Facebook, to be able to login to your application (This is identity services, where you don't have actual password, but rather access token with limited scope).

For that there is a Spring Social, project, that provides set of abstractions, for such kind of integration, including additional Spring MVC Controllers, needed for proper authentication in this Social Networks.