HybridAuth: OAuth and OpenID made easy

23 March 2012

Social media integration is becoming more and more common on websites these days. Visitors want to be able to log in using their Facebook, Google and Twitter accounts and site owners want to give their visitors the possibility to tell other people about their site on these social media.

Implementing these possibilities on your website requires knowledge of the OpenID and OAuth protocols, as well as specifics each site might have done differently than the standard. Once you start programming it, the code has a tendency to be a lot of copy-paste work with just small differences, and that isn’t making your code very clear.

As with a lot of programming problems there is a free, open-source solution: HybridAuth. HybridAuth tries to take away all specifics for the seperate social media sites and gives you a generic way of authenticating users to these sites while also providing API-access where applicable.

I think things like this are usually better explained with a piece of code(the code is inspired by examples from the HybridAuth website):

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

<?php
$config = dirname(__FILE__) . '/library/config.php'; // this config contains things like tokens and what providers are enabled
require_once './library/Hybrid/Auth.php';
try {
    $hybridauth = new Hybrid_Auth($config);
    /*
    * When the user is not authenticated this redirects that user to the twitter authentication page.
    * Twitter then sends the user back to this page
    * If the user is already authenticated it simply goes on to the next line of code.
    */
    $provider = $hybridauth->authenticate('Twitter');
    $user_profile = $provider->getUserProfile(); // getUserProfile() is available for every "provider" and contains basic information like the displayName and where allowed by the user: the e-mail address
    echo 'Hi there! ' . $user_profile->displayName;
    $provider->setUserStatus('Hello world!'); // This is an example of API-access, this specific function(getUserStatus()) is available in more providers    
    $account_totals = $provider->api()->get('account/totals.json'); // You can also directly call the api of a provider by using $provider->api()
    $user_contacts = $provider->getUserContacts(); // getUserContacts() is available in most providers, and does what it says: it gets the users friends/contacts
} catch(Exception $e) {
    echo 'Ooops, we got an error: ' . $e->getMessage();
}
?>

Now what if we want to do exactly the same, but for Facebook? That’s actually quite simple: the ONLY line we have to edit is the line that says:

1

$provider = $hybridauth->authenticate('Twitter');

and change it to

1

$provider = $hybridauth->authenticate('Facebook');

It really is that simple.

But does HybridAuth only support Facebook, Twitter and Google then? No, it supports way more, a list of all supported providers as of 23 march 2012:

• OpenID
• Facebook
• Twitter
• Yahoo
• Google
• MySpace
• Windows Live
• LinkedIn
• Foursquare
• AOL

And there is even an additional providers package available for download which adds support for:

• Github
• Gowalla
• LastFM
• Vimeo
• Viadeo
• Identica
• Tumblr
• Goodreads
• QQ
• Sina
• Murmur
• Pixnet
• Plurk

That is 23 different providers(counting OpenID as only 1 provider, even though multiple sites supports that). And even if you want your visitors to be able to login using another provider, it’s quite simple to add support for that, especially if that provider has OAuth support.

So does this HybridAuth library also have disadvantages?

The answer to that is: yes. But that doesn’t mean the library is useless. The biggest disadvantages I’ve found are:

1. If you plan to use it in a framework or CMS that abstracts for example the $_SESSION variable, it requires more fiddling than it seems at first sight to get it working. Even though there is a Storage class which you can easily edit to use something else than $_SESSION, the Storage class is not always used for storage, sometimes $_SESSION is hardcoded.
2. There are some small bugs that can still be quite annoying, and since the library seems to be largely maintained by one person it can take some time before the bug is solved in the main release.

For me these disadvantages don’t weigh up to the advantages. And if they don’t for you: just make a pull request at the Github page and fix it.

If you want to know more about HybridAuth you can visit the website: http://hybridauth.sourceforge.net/, which also has some documentation on how to use it.