c# - Linking credential-based authentication information with OAuth -

i implementing proof-of-concept site can optionally linked external provider. external provider used additional user data. provider conveniently exposes authentication oauth 1.0a.

to data, user authenticates on provider site , grant permission. easy.

the site uses servicestack. users register , login using credentialsauthprovider. have looked @ docs on servicestack, explored socialboostrapapi demo, , modeled services accordingly;

first, added user class, serialized db, hold additional data.

then, created customusersession, override onauthenticated method.

plugins.add(new authfeature(() => new customusersession(), new iauthprovider[] {             new credentialsauthprovider()         })); 

my onauthenticated method similar 1 in socialboostrapapi demo; walks through session.provideroauthaccess , gets necessary info out of them (looking oauthtokens of "externalprovider" provider).

of course, means when user gives authorization app on external provider, in oauth callback accesstoken, secret, everything, , put inside session.provideroauthaccess.

this, of course, works fine current session, if user logs off , on again, has authorize again (get new access token).

i need way save data put in session db; tried around found nothing (see my question here).

so, added code save them directly db:

var useroauthprovider = oauthtokens.translateto<useroauthprovider>(); useroauthprovider.userauthid = user.id; this.tryresolve<idbconnectionfactory>().run(db => db.save(useroauthprovider));  

now, when user authenticates, seems servicestack gets tokens userauthid , put them inside session. good!

first question

am doing in correct way?

second question

can rid of user/customusersession classes, , store additional info need in "items" dictionary in useroauthprovider/oauthtokens? make code simpler..

third question

at end of onauthenticate, socialbootstrapapi saves custom user table again:

authservice.tryresolve<idbconnectionfactory>().run(db => db.save(user)); 

why necessary? suppose copy info useroauthprovider table on user table (at next login after new authorization, example), why? session seems initialized correct data.