title: Accept facebook login into my REST API
body: <p>I have a backend server (Java / Spring / Spring Security). 
  Currently when users from mobile app login, they simply submit their username/password and Spring Security creates a Session and assign it to the request with a JSESSIONID.</p>
  
  <p>We would now also have a button on the mobile app "Login with Facebook". Here is my understanding of how it will work.</p>
  
  <ol>
  <li>mobile app uses facebook SDK to get an "access_token" </li>
  <li>mobile app retrive USer Profile from facebook (name,surname,email etc..)</li>
  <li>mobile checks (against MY server) if the username is unique</li>
  <li>If username unique, call MY REST api, with something like this /login/facebook POST over SSL and passing the access_token, email, username etc...)</li>
  <li><p>my server then checks if the access_token is valid </p>
  
  <p><code>GET graph.facebook.com/debug_token?
       input_token={token-to-inspect}
       &amp;access_token={app-token-or-admin-token}</code></p></li>
  <li>If yes, if the UID returned by facebook is already present in my local database, I signin the user as follow:</li>
  </ol>
  
  <pre class="lang-java prettyprint-override"><code>SecurityContextHolder.getContext().setAuthentication(
                  new UsernamePasswordAuthenticationToken(username, null, ROLE_USER));
  </code></pre>
  
  <ol start="7">
  <li><p>If i don't find the UID, I just create a new user and login the user.</p></li>
  <li><p>and from now on every request made to the server by the mobile will have the SESSION (created and attached by spring security) and the mobile app is authenticated</p></li>
  </ol>
  
  <p>Could someone tell me if this is a good way of doing things ?
  Should I stop using sessions and switch to Spring-Security-OAUTH2 ?</p>
  
  <hr>
  
  <p><strong>EDIT 1</strong></p>
  
  <p>Based on Dave advices here is the updated spring-security config:</p>
  
  <pre><code>    &lt;!- handle login by providing a token--&gt;
      &lt;security:http pattern="/login/facebook" auto-config="false" use-expressions="true" entry-point-ref="loginUrlAuthenticationEntryPoint"&gt;
                  &lt;security:custom-filter ref="facebookLoginFilter" position="FORM_LOGIN_FILTER"/&gt;
                  &lt;security:intercept-url pattern="/**" access="isAuthenticated()" /&gt;
      &lt;/security:http&gt;
  
  
      &lt;bean id="loginUrlAuthenticationEntryPoint" class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint"&gt;
                  &lt;constructor-arg value="/login/facebook"&gt;&lt;/constructor-arg&gt;
      &lt;/bean&gt;
  
      &lt;!-- handle basic username + password logins--&gt;
      &lt;security:http auto-config="true" use-expressions="true" entry-point-ref="forbiddenEntryPoint"&gt;
                  &lt;security:form-login login-processing-url="/security_check" authentication-failure-handler-ref="authFailureHandler"
                                       default-target-url="/" always-use-default-target="true" authentication-success-handler-ref="authSuccessHandler" /&gt;
                  ...
                  my others patterns..
                  ...
  
          &lt;/security:http&gt;
  &lt;bean id="forbiddenEntryPoint"
                  class="org.springframework.security.web.authentication.Http403ForbiddenEntryPoint" /&gt;
  
              &lt;bean id="authSuccessHandler" class="my.package.AuthenticationSuccessHandlerImpl"/&gt;
              &lt;bean id="authFailureHandler" class="my.package.AuthenticationFailureHandlerImpl"/&gt;
  
              &lt;bean id="facebookLoginFilter" class="pl.jcommerce.ocean.web.ws.controller.FacebookLoginFilter"&gt;
                  &lt;property name="requiresAuthenticationRequestMatcher" ref="loginRequestUrlHandler"&gt;&lt;/property&gt;
                  &lt;property name="authenticationManager" ref="authManager"&gt;&lt;/property&gt;
              &lt;/bean&gt;
  
              &lt;security:authentication-manager id="authManager"&gt;
                  &lt;security:authentication-provider ref="facebookAuthenticationProvider" /&gt;
              &lt;/security:authentication-manager&gt;
  
              &lt;security:authentication-manager&gt;
                  &lt;security:authentication-provider ref="webServiceUserAuthenticationProvider" /&gt;
              &lt;/security:authentication-manager&gt;
  
              &lt;bean id="loginRequestUrlHandler" class="org.springframework.security.web.util.matcher.RegexRequestMatcher"&gt;
                  &lt;constructor-arg index="0" value="/login/facebook" /&gt;
                  &lt;constructor-arg index="1" value="POST" /&gt;
                  &lt;constructor-arg index="2" value="false" /&gt;
              &lt;/bean&gt;
  </code></pre>