title: Facebook Authentication Workflow - Overly Complicated?
body: <p>I'm trying to build a <a href="http://developers.facebook.com/docs/guides/canvas/" rel="nofollow noreferrer">canvas iframe application for Facebook</a>. The app needs to do a couple of things:</p>
  
  <ol>
  <li>Within Facebook display a leaderboard comparing you to your friends</li>
  <li>Post messages to your wall</li>
  </ol>
  
  <p>Facebook recommend building all new apps as iframe apps, hence using this API.
   I've downloaded the PHP SDK and installed the example as my app. </p>
  
  <p>I'm confused as to why the example.php presents a login button to a user - isn't the idea that the current user is already logged into Facebook? </p>
  
  <p>My current solution redirects the user to <a href="http://graph.facebook.com/oauth/authorize" rel="nofollow noreferrer">http://graph.facebook.com/oauth/authorize</a> for authorisation, then grabs the OAuth token (for posting messages later) and heads back to an application page within the Facebook canvas. </p>
  
  <p>Is this really the only way to get the current Facebook user associated with my app, and to get permissions for posting messages later?</p>