I'm trying to figure out how to allow my users to login to my app using only Salesforce. I think I want to use the "web server oauth flow" and follow the directions in the solution here:
Namely this part where he says:
You can fire off immediate = true request, and right after it immediate = false in case first one failed. Then you send the access_token to your app by creating third request – to your own server.
He says the result of both of those calls (either immediate=false or immediate=true) will generate an access_token which I can send to my own server. But how do I tie this to a user account in my own database? Like, say if he's logged in before and so I already have an email address email@example.com in my database and I receive a web request to my redirect_url callback with an access_token (which happens to belong to Joe) - how can I know it belongs to firstname.lastname@example.org and I can grant the user a "Joe" session in my app?
Alternatively, if it's a new user account, how do I detect that and pull their user information from Salesforce (name, email address) so I can create a user account in my database, and grant them a valid session in my app?