Use 3rd party access token to protect access to API

[simonguest]

I have the sample up and working with Facebook, and can secure pages by applying the 'ensureLoggedIn' middleware - but I'm not sure how to secure APIs with the same authentication mechanism.

For example, I have an api (/api/people) that uses the rest datasource to call a REST endpoint running on a different server. I would like to allow access to only if the caller presents an oAuth token with the Facebook access_token and, ideally, that token should be passed through to the back end API as part of the call.

Hope this makes sense!

[marcelomogi]

I'm facing the same problem. I tried to use the access tokens generated when creating a user by 3rd party authorization and linking but no success.

[simonguest]

@raymondfeng I was on a call with @altsang this afternoon, and he mentioned that this feature might have been recently included in a recent update of loopback. Can you confirm?

[diaswrd]

@simonguest Any news on this?

I'm actually interested on using an access token from one loopback instance into another one. Instead of logging in 2 different APIs.

Any help is very appreciated. Thanks!

[tconroy]

+1, interested in this too.

[lughino]

+1

[cristtopher]

+1

[dakotahNorth]

+1

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.