title: Grails Rest API with OAuth for Mobile App
body: <p><strong>TL;DR : Read from EDIT 1</strong>.</p>
  
  <p>I'm trying to find a solution to how to implement authentication, especially OAuth for my rest api that will be used by a mobile app.</p>
  
  <p>I have found this popular <strong>plugin</strong> (<strong>Spring Security Rest</strong>):</p>
  
  <p><a href="http://alvarosanchez.github.io/grails-spring-security-rest/docs/guide/single.html#oauth" rel="nofollow noreferrer">http://alvarosanchez.github.io/grails-spring-security-rest/docs/guide/single.html#oauth</a><a href="https://i.stack.imgur.com/Pe02y.jpg" rel="nofollow noreferrer">1</a></p>
  
  <p>But the problem is that it's designed for javascript frontend app, so it needs a <strong>callback url</strong> to my frontend to pass the generated token (as you can see in the diagram).</p>
  
  <p>In the case of a mobile application, how can I do that ? Is there another plugin or design that I can implement for this ?
  I find it weird that there's really not a lot of plugins or tutorials about stateless OAuth in Grails or Spring but there's ton of mobile apps that use that.</p>
  
  <p>Here's an example of use case :</p>
  
  <ul>
  <li>User opens mobile app.</li>
  <li>User logs in with facebook on the mobile app.</li>
  <li>User does a request to api/orders which will return him only his orders.</li>
  </ul>
  
  <p>Who should handle the OAuth part in this ? The flow in the diagram presented on the plugin can't work with a mobile app, so should the mobile app auth to facebook, gets the token stores it then passes it to the web app ?</p>
  
  <p>I would like to understand what is the correct design/flow in this case, and if there`s a plugin or a way to implement it using grails. </p>
  
  <p><strong>EDIT : Is this a correct flow ?</strong></p>
  
  <p><img src="https://i.stack.imgur.com/Pe02y.jpg" alt="Mobile App OAuth + Auth to backend with external provider UML Sequence Diagram"></p>
  
  <p>If yes, is there a standard way to implement this with Grails ?</p>
  
  <p><strong>EDIT 2 :</strong> Now that I understand the flow, I need to integrate the login part with Spring security rest plugin (that already handles everything else).
  Here's the code that I want to integrate with the plugin but I don't know where or what to modify in the plugin :</p>
  
  <pre><code>    // api/auth/fb
  def auth(){
  
      //Extract fb_access_token
      String fbAccessToken = request.JSON.?fb_access_token
  
      //Call https://graph.facebook.com/me?access_token=fbAccessToken
      def userInfo = facebookService. ... (fbAcessToken) //Method to use in the plugin
  
      //Verify if the userInfo contains an error/doesn't contain a fbId
      if(userInfo.getFbId() == null ){
          respond unauthorized() // 401, Invalid access token
      }
      //Verify if this token is for our app
      else if(userInfo.getAppSecret() != System.env.getParameter("appSecret")){
          respond unauthorized() //401, token not for this app
      }
      //Register or login
      else{
          User user = User.findByFbId(userInfo.getFbId())
          if(user == null){
              facebookService.registerUser(userInfo) //Custom method implemented in the service
          }
          else{
              FbToken fbToken = new FbToken(userInfo.getToken(), userInfo.getExpiration())
              user.setFbAccessToken(fbToken)
          }
  
          //Login the user with spring security and let it handle the rest (token creation =&gt; storage =&gt; http answer)
  
      }
  
  }
  </code></pre>