22

Is there any free single-signon mechanism for Android that gracefully works with non-webapps? Say, something along the lines of...

  1. You launch my app and use it until it makes a request from the app server that requires authentication. It responds to that request with a random token that the server will associate with you for a short time.

  2. The app presents you with a username field, a password field, and a submit button.

  3. You enter your username and password. The app then forwards your username and hashed password, along with the token generated by the app server, to the login service.

  4. The login service determines whether or not your username and password are valid. If they are, it digitally timestamps and signs the token, and returns the signed token to the app.

  5. The app relays the signed token to the server.

  6. The server checks the signature, satisfies itself that it's valid and signed by an authority it trusts, and proceeds as though the user had presented IT with a valid local username and password instead.

I suspect I'm just getting lost in nomenclature, but the impression I've gotten so far is that all the usual SSO providers -- Twitter, Facebook, etc -- only allow users to log in using a normal browser, and that you're either not allowed to do what I described, or they do something to make it effectively impossible with anything besides a normal browser (like dynamically creating the login form via Javascript in an effort to prevent developers from trying to use their own apps as a login facade).

Alternatively, does there exist any workflow like THIS...

  1. You launch my app and use it until the web service requires you to log in. The app server generates a token and returns it to the app.

  2. The app spawns a new browser via intent that sends you to the login provider's web site, passing the token via intent to the browser (and ultimately the provider) as a POSTed formvar.

  3. You log in using the browser window, and the browser window closes -- returning you to my app.

  4. The login provider signs the token, then sends it directly to my app server via HTTP POST so I can note its submission, verify the cert, and treat it as though it were instead a valid username and password submitted directly by the user to the app server himself.

2
  • Er, maybe. In the case of OpenID, I guess a better question might be, "does there exist somewhere a coherent explanation of how to actually use OpenID in a real-world Android app with non-theoretical users?" So far, everything I've tripped over has been kind of like "This is how xxx is theoretically supposed to work, but to date nobody has actually pulled it off yet... or they did, but something that happened a few months later broke it."
    – Bitbang3r
    Commented Aug 29, 2010 at 15:43
  • 1
    take a look at code.google.com/p/openid4java Apparently, it has been modified to be used in android (groups.google.com/group/openid4java/browse_thread/thread/…)
    – ekawas
    Commented Aug 30, 2010 at 16:11

3 Answers 3

0

Have you tried or think of using Firebase? https://firebase.google.com/docs/auth/?hl=es-419

It has some useful tools, you can sign-in with multiple social connectors and user/password as well, and they provide a library to integrate the whole UI and server flow, they even take advantage of google smart lock for you.

Take a look at https://github.com/firebase/FirebaseUI-Android I used it in a personal project and saved me a lot of time.

0

What you described in Alternatively section looks like Authorization Code using Proof Key for Code Exchange (PKCE) OAuth 2.0 grant

https://www.rfc-editor.org/rfc/rfc7636

The flow is the following:

  1. Your app generates a random key (code_verifier) and it's transformed value (code_challenge) and navigates to authorization server with code_challenge as a parameter
  2. Authorization server redirects back to your app with authorization code
  3. Your app sends authorization_code and the code_verifier to the auth server to get the authorization token
  4. Server uses authorization_code and the code_verifier (it already has code_challenge, so it can verify that code_verifier is correct) and then returns to your app with the token.

On the practical side of it you can use something like Auth0 to implement it in your app.

1
  • is there any library that can do this smoothly in kotlin ?
    – Smaillns
    Commented Apr 24 at 18:46
0

Use Android Account Manager for SSO.

Providing references below just for knowledge. You have to dig into account manager.
Android developer: https://developer.android.com/training/id-auth
Blog with example: https://www.zoftino.com/android-account-manager-&-create-custom-account-type

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.