Orsdxy

Dears, I created a custom REST API, So customer can login Via facebook and twitter through mobile app. The API consists of one service which take some parameters and email parameter and check if this email is found or not.

-If found, then return customer id.

-If not found, then insert email and other parameters (firstname, lastname, socialid, socialtype).

My question, I don't save password for the customer because the response return from facebook doest not contain password, so how to get token authentication, so I can do all operations which request customer token?

In normal, I can login and get token through:

POST

 https://domain.com/index.php/rest/V1/integration/customer/token?username=test@gmail.com&password=12345

and response will be token.

What I understand from you question is, You have only email (and obviously some network specific secret key to validate i.e facebook key).

So You just need to load the customer by email id as below.

protected function getCustomerToken($emailId){

 /**

* @var MagentoCustomerModelCustomer $customer */

*/

$customer->loadByEmail($emailId);

if($customer->getId()){

        /**

        * @var MagentoIntegrationModelOauthTokenFactory $tokenModelFactory 

        */

        $customerToken = $this->tokenModelFactory->create();

        $tokenKey = $customerToken->createCustomerToken($customerId)->getToken();

        return $tokenKey;

}

return "YOU MSG FOR CUSTOMER NOT FOUND";

}

The above code should return the token key without password.

Note: Make sure you are doing proper & strong validating before generating the token & rest is already explained in Franck's answer .

I think you need to pass the Facebook auth token in order to validate your customer.

Extend the native token authentication with your logic to validate the Facebook token.

Usefull information: https://stackoverflow.com/questions/4623974/design-for-facebook-authentication-in-an-ios-app-that-also-accesses-a-secured-we

The same approach can works with Twitter.

Extend or create your own API endpoint in order to manage FB / Twitter Login.

The native code for token generation is located here :

vendor/magento/module-integration/Model/CustomerTokenService.php:74

/**

 * {@inheritdoc}

 */

public function createCustomerAccessToken($username, $password)

{

    $this->validatorHelper->validate($username, $password);

    $this->getRequestThrottler()->throttle($username, RequestThrottler::USER_TYPE_CUSTOMER);

    try {

        $customerDataObject = $this->accountManagement->authenticate($username, $password);

    } catch (Exception $e) {

        $this->getRequestThrottler()->logAuthenticationFailure($username, RequestThrottler::USER_TYPE_CUSTOMER);

        throw new AuthenticationException(

            __('You did not sign in correctly or your account is temporarily disabled.')

        );

    }

    $this->getRequestThrottler()->resetAuthenticationFailuresCount($username, RequestThrottler::USER_TYPE_CUSTOMER);

    return $this->tokenModelFactory->create()->createCustomerToken($customerDataObject->getId())->getToken();

}

Then you can modify the validation logic and the Magento customer ID retrieval in order to return a generated token.

If user is loggined

<?php





namespace TestModuleControllerTest;



use MagentoCustomerModelSession;

use MagentoFrameworkAppActionContext;





class Token extends MagentoCustomerControllerAbstractAccount

{

    /**

    * @var MagentoCustomerModelSession

    */

    protected $_customerSession;



    public function __construct(

        Context $context,

        Session $customerSession,

        MagentoIntegrationModelOauthTokenFactory $tokenModelFactory

    ) {

        $this->_customerSession = $customerSession;

        $this->_tokenModelFactory = $tokenModelFactory;

        parent::__construct(

            $context

        );

    }



    public function execute()

    {

        $customerId = $this->_customerSession->getCustomer()->getId();

        $customerToken = $this->_tokenModelFactory->create();

        echo "Customer-token=> ".$tokenKey = $customerToken->createCustomerToken($customerId)->getToken();

    }

}

If you need login without enter password

class AutoLoginManagement implements FloCoreApiAutoLoginManagementInterface

{



    protected $_customer;

    protected $_customerSession;

    protected $_tokenModelFactory;



    public function __construct(

        MagentoIntegrationModelOauthTokenFactory $tokenModelFactory,

        MagentoCustomerModelCustomer $customer,

        MagentoCustomerModelSession $customerSession

    )

    {

        $this->_customer = $customer;

        $this->_customerSession = $customerSession;

        $this->_tokenModelFactory = $tokenModelFactory;

    }



    public function postAutoLogin($data)

    {



        $objectManager = MagentoFrameworkAppObjectManager::getInstance();

        // Load customer

        $customer = $objectManager->create('MagentoCustomerModelCustomer')->load($data['customer_id']);



        if(! $customer->getId()) {

            return 'Not Found';

        } else {

            // Load customer session

            $customerSession = $objectManager->create('MagentoCustomerModelSession');

            $customerSession->setCustomerAsLoggedIn($customer);



            $customerToken = $this->_tokenModelFactory->create();

            $tokenKey = $customerToken->createCustomerToken($customer->getId())->getToken();

            return $tokenKey;



        }



    }



    private function getCustomerToken($customerId)

    {

        $customerToken = $this->tokenModelFactory->create();

        $tokenKey = $customerToken->createCustomerToken($customerId)->getToken();

        return $tokenKey;

    }

}