the function call fb_require_authorization need to use facebook api call for login url such:

	$params = array(
		'next' => $redirect_uri,
		'cancel_url' => $redirect_uri,
		'req_perms' => YOUR_PERMISSIONS,
	);
	$url = $fb->getLoginUrl($params);

this instead of the current code:

    $url = "https://graph.facebook.com/oauth/authorize?client_id=$client_id&redirect_uri=$redirect_uri";

The login url should be something like this: 

https://www.facebook.com/login.php?api_key=API_KEY&cancel_url=http%3A%2F%2Fapps.facebook.com%2FCANVAS%2FSOME_PATH1&display=page&fbconnect=1&next=http%3A%2F%2Fapps.facebook.com%2FCANVAS%2FSOME_PATH2&return_session=1&session_version=3&v=1.0&req_perms=PERMS,DIVIDE,BY,COMMAS

This due to facebook api docs:
* http://developers.facebook.com/docs/authentication/
* http://thinkdiff.net/facebook/php-sdk-graph-api-base-facebook-connect-tu...
Notes:
* I didn't find how retrieve the drupal facebook module permissions to put in this call.
* The params should be (from FB sdk source code):

   * The parameters:
   * - next: the url to go to after a successful login
   * - cancel_url: the url to go to after the user cancels
   * - req_perms: comma separated list of requested extended perms
   * - display: can be "page" (default, full page) or "popup"

* maybe the cancel url should be different from redirect uri

Comments

Dave Cohen’s picture

Dave Cohen commented
Issue tags: -authentication, -API +fb-volunteer

Looks like facebook has changed the URLs since fb_require_authorization() was first written. I can't find documentation for the .../oauth/authorize URL any more. But likewise I can't find documentation for your suggestion $fb->getLoginUrl() or .../login.php.

If fb_require_authorization() is going to change, shouldn't it use http://www.facebook.com/dialog/oauth, as described on http://developers.facebook.com/docs/authentication/

oc666’s picture

oc666 commented

From the php sdk code (above the function getloginurl function), you can pass param named display. It could be "page" (default, full page) or "popup". So it required when you configured the fb connect module. If you are running from canvas, it required to be page (I tested this already with my app). If it from external site, it should be popup (for my opinion).