Login with Native Android FB Login and CB API

Hi Kyle,
We are creating a native android app with an FB Login using CB API.

how can i login a user into cb (using CB API) in the backend without user interaction (i.e. without login credentials) after he/she has logged into an external provider like facebook?

I think cbconnect implements this behaviour, but it has not become quite clear how (we have looked through the code but are non the wiser).

Also, how do we do the @link to already existing account according to Email Adress@? eg a user has already an account using the traditional login (password + username) and decides to login using FB login. That would mean it would need to identify the right user account based on email address sent from FB.

Thanks in advance

Tim

The login API can bypass authentication by simply using the login function without a password. See the login function of components/com_comprofiler/plugin/user/plug_cbconnect/component.cbconnect.php for usage details.

CB Connect only links if they've logged in normally through Joomla then used the link button. What you're wanting it to do is a massive security vulnerability. To put it into perspective you're wanting to allow Facebook accounts to takeover Joomla accounts based off the sole value of their email address, which you can change to whatever you want on Facebook or even in the application permissions dialog. It's certainly doable, but it will never be implemented into CB Connect.

As for the rest that's all implementation details regarding native app development that I can't help you with.

OK understood,

how can we then instead link the fb accounts with cb accounts in a secure way? Any examples?

Tim

You can't without first logging in to CB as CB Connect already requires for linking. Username and Email Address absolutely are not safe to depend on as you could easily hijack someones account doing that. Best way to handle this scenario is if the username or email address (both need to be unique) is in use then ask them to login then link the accounts after they've logged in.