You Are Who You Are
One of the complaints we heard longest and loudest from users of 2cloud was that the authentication flow was terrible. That's because it was. It was a hack: browser redirects leading you through an OAuth 1.0a dance, because that's the only option App Engine gave us.
We've been working on the 2cloud server stuff for a while now, and left the authentication as OpenID for all this time. It was all we needed to test the service out, and we reasoned that we'd come back and add in whatever we needed to support Android later. We never planned on leading users through a crappy, hacked-together browser flow, but we didn't know what server-side code was required to use the tokens returned by Android's AccountManager—the built-in list of accounts you've added to your device.
Tonight I took the time to find out, and have successfully implemented a test application that will retrieve a Google account token from your device and send it to our server, which will match it up with your account, create an account, or report an invalid token. There's a lot to be done on it still, but it's a very strong foundation to build on. Logging in to your device will be as simple as selecting the Google account you want to use from a list.
I worked hard to make sure your Google account would be matched across both OpenID and OAuth2 authentication schemes. The same Google account gets you credentials for the same 2cloud account.
I also laid the groundwork for future authentication mechanisms. There doesn't seem to be a good reason that you can't, for example, use your Facebook account to log in. Or your Twitter account. Or even your custom OpenID endpoint.
For our initial release, we're going to only accept Google accounts. As we iterate, however, we're going to work hard to make sure that you can authenticate yourself in whatever way you choose. You are not a Google account, and we know that.
