|
| 1 | +--- |
| 2 | +title: Publisher Integration with SSO Providers |
| 3 | +description: Information for publishers for using single sign-on (SSO) providers with UID2. |
| 4 | +hide_table_of_contents: false |
| 5 | +sidebar_position: 06 |
| 6 | +--- |
| 7 | + |
| 8 | +import Link from '@docusaurus/Link'; |
| 9 | + |
| 10 | +# Publisher Integration with SSO Providers |
| 11 | + |
| 12 | +This guide provides information for publishers who use popular single sign-on (SSO) providers and want to integrate with UID2. |
| 13 | + |
| 14 | +## High-Level Steps |
| 15 | + |
| 16 | +To integrate with a single sign-on solution, the general steps are as follows: |
| 17 | + |
| 18 | +1. Get an identity token from the SSO provider. |
| 19 | + |
| 20 | +2. Extract the user's email address from the identity token. |
| 21 | + |
| 22 | +3. Pass the user's email address to the [UID2 publisher integration](../guides/summary-guides.md#publisher-integrations) of your choice. |
| 23 | + |
| 24 | +:::note |
| 25 | +To find out whether you have to apply [normalization and encoding](../getting-started/gs-normalization-encoding.md) to the email address, or the integration does it for you, check the documentation for your UID2 publisher integration. |
| 26 | +::: |
| 27 | + |
| 28 | +## Sign In with Google |
| 29 | + |
| 30 | +The following options are available for sign-in with Google: |
| 31 | + |
| 32 | +- [SO with Google for Android](#sso-with-google-for-android) |
| 33 | +- [SSO with Google for iOS and macOS](#sso-with-google-for-ios-and-macos) |
| 34 | +- [SSO with Google for Web](#sso-with-google-for-web) |
| 35 | + |
| 36 | +### SSO with Google for Android |
| 37 | + |
| 38 | +Follow the instructions in [Create the Sign in with Google flow](https://developer.android.com/identity/sign-in/credential-manager-siwg#create-sign). Once the token has been validated, you can retrieve the email address by using the [getEmail() method](https://cloud.google.com/java/docs/reference/google-api-client/latest/com.google.api.client.googleapis.auth.oauth2.GoogleIdToken.Payload#com_google_api_client_googleapis_auth_oauth2_GoogleIdToken_Payload_getEmail__) of the identity token payload. |
| 39 | + |
| 40 | +### SSO with Google for iOS and macOS |
| 41 | + |
| 42 | +To get an email address from [Sign in with Google](https://developers.google.com/identity/sign-in/ios/start-integrating) on iOS or macOS, retrieve it from the `GIDGoogleUser` object. For details, see [Getting profile information](https://developers.google.com/identity/sign-in/ios/people). |
| 43 | + |
| 44 | +### SSO with Google for Web |
| 45 | + |
| 46 | +Follow the instructions to [verify the Google ID token on your server side](https://developers.google.com/identity/gsi/web/guides/verify-google-id-token), and then retrieve the user's email address from the email field of the ID token. |
| 47 | + |
| 48 | +## Facebook Login |
| 49 | + |
| 50 | +There are two ways to integrate Facebook Login with UID2: with an <Link href="glossary-uid#gl-oidc">OpenID Connect (OIDC)</Link> token or without. |
| 51 | + |
| 52 | +### Facebook SSO Using an OIDC Token on iOS |
| 53 | + |
| 54 | +To get an email address from [Facebook Login](https://developers.facebook.com/docs/facebook-login/) using an [OIDC token](https://developers.facebook.com/docs/facebook-login/guides/access-tokens/get-oidc/) on iOS: |
| 55 | + |
| 56 | +1. Implement Facebook Login (for details, see [Use Facebook Login in Your iOS App](https://developers.facebook.com/docs/ios/use-facebook-login)) and request the email permission. |
| 57 | + |
| 58 | +1. Extract the user's email address from the OIDC authentication token: for example, by using the Profile helper class. For details, see [OIDC Tokens in Facebook Login for iOS](https://developers.facebook.com/docs/facebook-login/guides/access-tokens/get-oidc). |
| 59 | + |
| 60 | +### Facebook SSO Without an OIDC Token |
| 61 | + |
| 62 | +To get an email address from [Facebook Login](https://developers.facebook.com/docs/facebook-login/) without using an OIDC token: |
| 63 | + |
| 64 | +1. Request a [user access token](https://developers.facebook.com/docs/facebook-login/guides/access-tokens#usertokens), specifying the `email` permission. |
| 65 | + |
| 66 | +1. If the user has granted the `email` permission, make a Graph API call to the [/me endpoint](https://developers.facebook.com/docs/graph-api/overview#me), using the user access token, and specify `email` as one of the fields. |
| 67 | + |
| 68 | +### Sample Applications |
| 69 | + |
| 70 | +The following applications are available as examples to help you code your Facebook SSO integration for mobile apps: |
| 71 | + |
| 72 | +- [Facebook Login sample application for Android](https://github.com/facebook/facebook-android-sdk/tree/main/samples/FBLoginSample) |
| 73 | + |
| 74 | +- [Facebook Login sample application for iOS](https://github.com/facebook/facebook-ios-sdk/tree/main/samples/FacebookLoginSample) |
| 75 | + |
| 76 | +## Sign In with Apple |
| 77 | + |
| 78 | +The instructions for signing in with Apple are different for apps and websites. |
| 79 | + |
| 80 | +### Sign In with Apple in a Mobile App |
| 81 | + |
| 82 | +Request authorization, making sure to request the `email` scope. For details, see [Request Authorization with Apple ID](https://developer.apple.com/documentation/sign_in_with_apple/implementing_user_authentication_with_sign_in_with_apple#3546458). |
| 83 | + |
| 84 | +If authentication succeeds, retrieve the user's email address from the `email` property of the `ASAuthorizationAppleIDCredential` object. |
| 85 | + |
| 86 | +### Sign In with Apple JS on a Webpage |
| 87 | + |
| 88 | +Refer to the section [Handle the Authorization Response](https://developer.apple.com/documentation/sign_in_with_apple/sign_in_with_apple_js/configuring_your_webpage_for_sign_in_with_apple#3331292) of the page [Configure your webpage for Sign in with Apple](https://developer.apple.com/documentation/sign_in_with_apple/sign_in_with_apple_js/configuring_your_webpage_for_sign_in_with_apple). |
| 89 | + |
| 90 | +## Sign In with OpenPass |
| 91 | + |
| 92 | +To get an email address from an [OpenPass](https://openpass.thetradedesk.com/en) integration: |
| 93 | + |
| 94 | +1. Use the [OpenPass API](https://partner.thetradedesk.com/v3/portal/openpass/doc/OpenPassQuickstartsServerSide) or one of the [OpenPass SDKs](https://partner.thetradedesk.com/v3/portal/openpass/doc/OpenPassSDKs) to get an identity token. |
| 95 | + |
| 96 | +1. Extract the user's email address from the `email` claim of the identity token. For details, see [OpenPass Authentication Tokens](https://partner.thetradedesk.com/v3/portal/openpass/doc/OpenPassTokensAuth). |
0 commit comments