title: Authenticate user logged in with FB at my server using the Android Account Manager
body: <p>I have a question about authentication using the Android Account Manager. We have a backend and an Android app and the user should log into our backend using his Facebook account. Currently we show a webview for this purpose which does normal oAuth 2 but using the Android Account Manager is more secure and much easier for the user so we want to switch. My question is, how can the server validate if the user is really who he pretends to be. Since we cant trust the App we have to talk to fb from the server side to validate if the user really is who he pretends to be. Based on a quite <a href="https://stackoverflow.com/questions/11631928/authenticating-with-oauth2-for-an-app-and-a-website">similar idea</a> I made the following diagram to ask you if this is the correct way to do it or if I missed something:</p>
  
  <p><img src="https://i.stack.imgur.com/3iGj8.png" alt="Steps before the user is authenticated at &quot;My Server&quot;">
  The flow would look like this:</p>
  
  <ol>
  <li>User wants to log in with his facebook account</li>
  <li>The Android Account Manager is shown where he picks the facebook account</li>
  <li>The user grants access that "My app" is allowed to access his fb data</li>
  <li>The Android Account Manager gets an auth token from the Facebook server</li>
  <li>The "My App" now has the auth token and can access the fb data of the user</li>
  <li>The "My App" passes the tokten to "My Server"</li>
  <li>The "My Server" now checks if token valid by getting the user data from the fb server</li>
  <li>If the token was valid the "My Server" gives back a normal temporary valid cookie for the current session with "My App". The user is now logged in at My Server with his fb account.</li>
  </ol>
  
  <p>So is this the correct way? Is step 6 a good idea to pass the token once to "my server" or is there a better way? Btw Facebook is just an example here, we use different auth providers like FB, Google and Twitter but the flow should be the same for each one. </p>