0

I want:

  • central oauth2 server which will hold all user accounts and will provide platform for user account management
  • multiple services which will connect to central oauth2 server to verify user. Each service will have Web and mobile applications (iOS, Android)

I followed spring-boot-oauth tutorial and have client that connects to server for credentials using redirect. This works fine for browsers, but I wish to be able to login directly in native apps. I think using grant_type=password should solve the problem, but I can not find good description how to approach this.

  1. Should I send token request directly to central server for refresh token, or should I proxy it through each application service?
  2. Is there any way to check on native app if user is already logged in central server from device, or do I always need to send login/password? I'm aware that I could develop separate application to which I will redirect user for verification, but for user-experience and time-efficient reasons I would like to avoid it.

1 Answer 1

1

If you are thinking of native mobile apps on Android and iOS, then I would recommend looking at these libraries...

https://openid.github.io/AppAuth-iOS/

https://openid.github.io/AppAuth-Android/

These libraries allow you to use implicit or code authorization flows, avoiding the grant_type=password flow which makes it more difficult to get single sign on.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.