Using oAuth (Twitter, LinkedIn) for login to a web app

Should I use oAuth, for example LinkedIn or Twitter, as my signin mechanism开发者_C百科 for my app? It seems that most apps just use oAuth to connect other services to it, but they make you set up your own user/password after you use oAuth (including StackOverflow), and I'm not really sure why this is. Would love some insight here. Thank you.

---

Why not use OpenId, to allow people to sign into your application, without having to type any specific login/password ?

Quoting the corresponding wikipedia entry :

OpenID is an open, decentralized standard for authenticating users which can be used for access control, allowing users to log on to different services with the same digital identity where these services trust the authentication body.
OpenID replaces the common log on process that uses a login-name and a password, ...

BTW, that's exactly how one logs-in on stackoverflow ;-)

---

OAuth purpose is not authenticating your users with your site, is letting your users allow you (the oauth consumer) access to their protected resources in other sites (oauth providers) like LinkedIn, Twitter, Google APIs etc.

For authentication, you should use OpenId as others have pointed

---

Twitter provides a Sign in with Twitter flow that is OAuth but provides a faster redirect if it is an existing user of your service and they are already authenticated with Twitter.

http://apiwiki.twitter.com/Sign-in-with-Twitter

If you are building a Twitter centric application this makes a lot of since to use and you won't have to implement an entire alternate authentication method like OpenID.

Be careful if you let users authenticate with both Twitter and LinkedIn as users will inadvertently create two accounts and need them to be merged.

---

Facebook and Twitter both have the "Login with Facebook/Twitter" APIs to actually allow users to login without having to create an account for your website. Both of them will return you a valid session that may (or may not) expire. So you actually wouldn't have to ask users to decide on a username/password, as you can fetch both from the APIs (you can not get the users email address when using Twitter though)

So why add those functions to your website?

Users are in general more likely to hit the "Login with ..." button than going through the whole mail address authorization process and entering their name, etc...

---

Linkedin only has OAuth for usage to its API. It will also depend on what type of language you are writing your webapp in, they should have premade wrapper libraries you could tap on to.