I read the readme.txt. from top to bottom

I am facing with a strange phenomen when using dff, but am not sure whether this is a bug.

I have a drupal 6 (current version) website which is a facebook connect application and am using facebook for drupal (current version). Everything works fine so far, users can register and login at my drupal site via their facebook login. Thanks to the great ffd module! Users hit the facebook connect button on the frontpage, login or registration page. For new users a new account is created.

However: When a user is logged in at facebook and subsequently visits my website, then the users gets automatically registered with drupal and logged in. This happens even if the visitor has not pressed the facebook connect button and even if the page visited (e.g. the contact form) does not bear a facebook connect button at all.

I would like to avoid this and have facebook logged in users registered with my site only when clicking the facebook connect button. How can I avoid the automatic registration? Is this a settings problem?

I have attached a screenshot of my facebook app node settings for further information

Hope my problems became clear?

CommentFileSizeAuthor
app-node-settings.JPG116.51 KBscoorch

Comments

Dave Cohen’s picture

Dave Cohen commented
Category: bug » support

there's a radio button labelled "Create Local Account". Select the other option, and the module will never create a local account. Then you can write your own module with just the logic you're looking for.

scoorch’s picture

scoorch commented

David, Thanks for the quick reply.

On the settings page it says:

This option will create a local account automatically and create an entry in the authmap table. This happens whenever the user visits a canvas page, except pages whose path starts with "user/" and the landing page for anonymous users. Choose never to use Drupal's built in user registration.

I assumed this inly applies to canvas pages but not to fb connect pages.

The fb hook op FB_OP_APP_IS_AUTHORIZED is called when a user has authorized the app. Could be they visited a canvas page, or could be they clicked a fbConnect link. If the app is a *fb connect page* and not a canvas page then local I would suggest that accounts should only be created if users have clicked on a fbConnect link. Otherwise they are registered without haveing accepted the terms and conditions etc. I am not sure if this would be in line with facebooks terms of service.

Maybe I did not very well formulate the issue. It is not only the automatic registration but the automatic login. When a user comes to a drupal facebook connect website and is already logged into facebook, then login into drupal should only occur when hitting a facebook connect button, but not by merely visiting the page?

Addition: Just found out that the automatic login only occurs when the user has previously accepted the app. So this was a testing error.

Thomas

Dave Cohen’s picture

Dave Cohen commented
Status: Active » Fixed

I'll change the text. local accounts are created when users visit any application they have authorized, both canvas and connect. In fact facebook calls a callback behind the scenes and that can create a local account, too.

The local account will never be created if user has not authorized the app. In that case we can't even learn their facebook user id.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.