8

I'm the administrator of a small group on Facebook, it has about 40-50 members. Now I'm building a webpage for the group which will authorize users using Facebook Login (I'm using Laravel + SammyK's LaravelFacebookSDK if that matters).

Everything works fine, there is a problem though. I'd like to restrict login for only those who are members of the Facebook group. The best way would be using the /me/groups API, but that requires user_groups permission, which is restricted.

Of course there are 'hacky' solutions like making each user manually to an App Insight user or writing a script that updates a database on my server every day that contains the list of the group members, but isn't there a simple, elegant way to do this?

I highly doubt Facebook will allow me to use the user_groups permission just for this.

3
  • 1
    You could try to convince them it will improve the user experience. Otherwise go for the hacky solution :)
    – lsouza
    Jan 14, 2015 at 21:20
  • I'm in the same point. Facebook should allow user_groups scope for most cases. Feb 11, 2015 at 8:57
  • NOTICE EVERYONE - this is a known bug of Facebook. in order to "help" facebook decide to fix it, you should all subscribe to this bug and comment that you need it fixed. here is the bug: developers.facebook.com/bugs/267362886791339
    – Shahar
    Apr 20, 2016 at 9:13

3 Answers 3

2

Well the graph API does provide this functionality as you said, you would just need user permission, not facebooks. As you could communicate the need and benefits of this permission, you would just need to write it down, somewhere close to your registration/login. You then need to specify the user_groups inside the scope variable, that your sending with the getLoginUrl Method.

$scope = ['email', 'user_status', 'user_groups']; // it is 'groups' or 'user_groups'
$login_url = $fqb->auth()->getLoginUrl('http://my-callback/url', $scope);

I did not test this code, as I do not have an installation at hand, but from everything I just read, this is how it should work.

Edit: Almost forgot, you would get the data out of your Facebook object using the following notation:

 $groups = $fqb->object('me/groups')->get();
4
  • According to the Facebook API documentation, user_groups permission is restricted and will not be granted unless Facebook reviews my application and explicitly allows it.
    – nxu
    Jan 17, 2015 at 14:33
  • Indeed, I've just tested it. Although the login link has scope=user_groups in it, it only asks for the public page permission and when I try to get the me/groups data, an empty set is returned.
    – nxu
    Jan 17, 2015 at 14:43
  • Then I misinterpreted there guidelines. Sorry for that.
    – ricktap
    Jan 17, 2015 at 16:09
  • NOTICE EVERYONE - this is a known bug of Facebook. in order to "help" facebook decide to fix it, you should all subscribe to this bug and comment that you need it fixed. here is the bug: developers.facebook.com/bugs/267362886791339
    – Shahar
    Apr 20, 2016 at 9:14
1

Looks like there is only one nice way to achieve this:

Although /me/groups requires user_groups permission to retrieve groups the user is a member of, it can return groups created by the app without it (given there is a valid access token of course).

So - while it's clearly not as nice and seamless as I wanted it to be - my solution was to create a new Facebook group using the app (requires only a POST request) and move current members to this new one.

Edit: moving members is not a possibility, joining an app group is only possible programatically using the SDK. Therefore, when a user is not a member of this group, I'll prompt them to join. It means that everybody can join and I have to manually ban those I don't like instead of manually allowing those I want to, but given the low publicity, I can deal with this.

1
  • 1
    "App and Game Groups are deprecated. API access for new apps will be closed on May 1, 2016. Game and App Groups will be deprecated for all apps on October 17, 2016."
    – Mr Rebel
    Feb 20, 2017 at 23:37
0

Yeah this is quite "fun" to implement. I remember being able to do it, but I don't have any specific code to help unfortunately. I can tell you, that it will require multiple tokens.

If I remember correctly, this is the logical flow:

Get the user's own token.
Then the group's token using the user's token.

And then you would control the data the individual is allowed to send to the group from within your application.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.