Login via Facebook OAuth2 Identity Provider

Create Facebook Applicaton

Goto https://developers.facebook.com/apps/ and create new Facebook Application Goto Application Dashboard. Then goto Settings -> Basic. There will be your app App Id and App Secret.

Setup OpenAM

Legacy UI

Login into console. Goto Access Control then select target realm. Goto Authentication

Create Authentication Module

Under section Module Instances create new Authentication Module. Enter new module instance name, for example facebook. Authentication module type is OAuth 2.0 / OpenID Connect

Then select module, you’ve just created from module list and enter following settings:

Setting Value

Client Id

Your Facebook Application App Id

Client Secret

Your Facebook Application App Secret

Authentication Endpoint URL

https://www.facebook.com/dialog/oauth

Access Token Endpoint URL

https://graph.facebook.com/oauth/access_token

User Profile Service URL

https://graph.facebook.com/me

Scope

Here you should enter scope, according to Facebook documentation for example email

OAuth2 Access Token Profile Service Parameter name

access_token

Proxy URL

[Your OpenAM URL]/oauth2c/OAuthProxy.jsp for example: https://openam.example.com/openam/oauth2c/OAuthProxy.jsp

Account Provider

org.forgerock.openam.authentication.modules.common.mapping.DefaultAccountProvider

Account Mapper

org.forgerock.openam.authentication.modules.common.mapping.JsonAttributeMapper

Account Mapper Configuration

Attribute configuration that will be used to map the account of the user authenticated in the OAuth 2.0 Provider to the local data store in the OpenAM. Example: id=facebook-id email=mail

Attribute Mapper

org.forgerock.openam.authentication.modules.common.mapping.JsonAttributeMapper

Attribute Mapper Configuration

Attribute configuration that will be used to map the user info obtained from the OAuth 2.0 Provider to the local user data store in the OpenAM. Example: last_name=snlast_name=facebook-lnameemail=mailfirst_name=givennamefirst_name=facebook-fnamename=cnemail=facebook-emailid=facebook-id

You can setup remaining attributes on your own, depending your authentication process requirement and press Save and then Back to Authentication

Create Authentication Chain

Under section Authentication Chaining create new Authentication Chain, enter its name, for example, facebook and add recently created module facebook

Your authentication chain should look like this:

Instance Criteria Options

facebook

Required

Test your Authentication Chain

Goto [Your OpenAM URL]/UI/Login?org=[your org]&service=[facebook auth chain], for example, http://example.openam.com/openam/UI/Login?org=/&service=facebook and you should see facebook authentication dialog