Check login data for Google with Android?

Question

I would like to link the app account to Google. Almost every Android user would have an GMail Account. So I read out the accounts:

private String[] getAccountNames(){
    mAccountManager = AccountManager.get(this);
    Account[] accounts = mAccountManager.getAccountsByType(GoogleAuthUtil.GOOGLE_ACCOUNT_TYPE);
    String[] names = new String[accounts.length];
    for (int i=0;i<names.length;i++){
        names[i] = accounts[i].name;
        Toast.makeText(this, accounts[i].name, Toast.LENGTH_LONG).show();
    }
    return names;
}

The user can choose one account and has to enter the password to verify the access to this account and link it to the app. How can I check if the password is correct? What is the server to check the login? I just need a response (true or false) if login was successful or not.

Answer 1

You should not ask for the Gmail password of the users - it's very insecure, people don't like to give it to any app, it could send it to anyone. Also, if users are using 2 step verification, you also need to handle this - it would be difficult to implement correctly.

Insted, you should ask for an authentication token from Android. With these tokens you can check from the client (e.g. using this url: https://www.googleapis.com/oauth2/v1/tokeninfo?id_token=[your-id-token-here]) and also from your server, whether it's the user's account. You can read more about this in this blogpost: http://android-developers.blogspot.com/2013/01/verifying-back-end-calls-from-android.html

Answer 2

You should ask for the users permission and get a token using this:

GoogleAuthUtil.getToken(activity, account, "oauth2:https://www.googleapis.com/auth/userinfo.profile");

After the user approves your request the above call will return a token that you can use to do api calls on behalf of the user.