Google Cloud Endpoint authentication with Facebook

Question

I would like to integrate facebook authentication into my app. It's an distributed system using GAE as backend and Android app on the client side. For the communication I am using the Google Cloud endpoints.
Reading this article I stayed a little confused, because it seems to be they are describing there only Authentication provided by Google and not truly the authentication by other providers as the title may suggest.
What information about "how does the authentication mechanism with facebook as OAuth2 provider should work" I have after spending hours with googling:

1. I have an access token generated by Facebook authorization servers.
2. I know I should pass this access token to backend in the HTTP Authorization header.
3. Since I am using custom authentication mechanism (not provided by Google) I should write an custom Authenticator, which implements this interface. This step was explained in this answer.
4. In the custom authenticator I should validate the access token and resolve user_id from the access token.
5. The authenticate(HttpServletRequest request) method should return User representing the owner of the access token.
6. The User returned in step 5 is the one, who is injected into endpoint methods.

I am still not 100% sure if these steps are correct, so please correct me if I am wrong.
What information is missing

1. I guess the User returned by authenticate(HttpServletRequest request) method method represents any authenticated User (not only User authenticated by Google authentication mechanism). Since it's not clear from the documentation of the authenticate(HttpServletRequest request) method, is the User returned by the method the type com.google.appending.api.users.User ?

Answer 1

My answer to this question might help point you to the right tools/solution for your context (and the respective documentation): What is the difference between Google identity toolkit, Google OAauth and Google+ sign in