mlavin / django-all-access

django-all-access is a reusable application for user registration and authentication from OAuth 1.0 and OAuth 2.0 providers such as Twitter and Facebook.
http://readthedocs.org/docs/django-all-access/
BSD 2-Clause "Simplified" License
60 stars 29 forks source link

missing email field on info (user profile) #58

Closed ghost closed 9 years ago

ghost commented 9 years ago

I override the get_or_create_user to include the user's email on the process of creating the new Django's user but it seems that the email is not comming along with the base request for the profile. I'm currently testing only with facebook. I'm sure that i passed the correct scopes for this type of request. It's shows up on the login window that i'am requesting "email" and i was testing with my own profile which i provided an public email. :/

So i kinda confusing here. The facebook page is not much clear if the email come along through the profile url or i need to make additional request.

my get_additional_parameters is the same from the docs

and here is the get_or_create_user

class OAuthScopedCallback(OAuthCallback):

    def get_or_create_user(self, provider, access, info):
        user = super(OAuthScopedCallback, self).get_or_create_user(provider, access, info)
        # Check for a name
        print('Check for a name')
        try:
            names = info['name'].split()
            user.first_name = names[0]
            if len(names) > 1:
                user.last_name = names[-1]
            else:
                user.last_name = ''
        except:
            print('no names :(')
        # Check for a email
        print('Check for a email')
        try:
            user.email = info['email']
        except:
            print('no email, bitch! :(')
        user.save()
        return user
mlavin commented 9 years ago

What is the output here? What's the value of info? Note that get_or_create_user is only called during handle_new_user, that is if you've previously authenticated via Facebook and your user matches an AccountAccess then it won't be called.

ghost commented 9 years ago

Yeah that's why i choose to override this method. I wanted to fill up this infos right up on the user model creation. Here is the output of the info: {'name': 'Ramon Moraes', 'id': '1653467144933268'}.

mlavin commented 9 years ago

There you go. Facebook didn't give you the email: https://developers.facebook.com/docs/facebook-login/permissions/v2.4#reference-email

Note, even if you request the email permission it is not guaranteed you will get an email address. For example, if someone signed up for Facebook with a phone number instead of an email address, the email field may be empty.

ghost commented 9 years ago

Hum. I'm pretty sure that my account was maded with email! .-.

mlavin commented 9 years ago

The first sentence if more important than the second, which is only one example why it may be missing. Facebook doesn't have any way to guarantee you will get an email back. Twitter does not provide any way to get the user's email. If you require an email then you will have to enforce that in your application. I think there is an open case to document this as a workflow customization. The basic follow would be to store the AccountAccess in the session redirect the user to a new form to give the email. Once you have the email, you would create the user and associate with the AccountAccess. Email verification would be another potential step.

ghost commented 9 years ago

Yeah. Thanks again for the help! I will try to put an example of this over my fork before the pull

mlavin commented 9 years ago

Closing because I don't believe there is anything to address here. This project doesn't claim to guarantee the email will available for the newly created because it can't in general for any provider.