AppAuth-Android | Android client SDK for communicating with OAuth 20 and OpenID Connect providers | OAuth library
kandi X-RAY | AppAuth-Android Summary
kandi X-RAY | AppAuth-Android Summary
AppAuth encapsulates the authorization state of the user in the net.openid.appauth.AuthState class, and communicates with an authorization server through the use of the net.openid.appauth.AuthorizationService class. AuthState is designed to be easily persistable as a JSON string, using the storage mechanism of your choice (e.g. SharedPreferences, sqlite, or even just in a file). AppAuth provides data classes which are intended to model the OAuth2 specification as closely as possible; this provides the greatest flexibility in interacting with a wide variety of OAuth2 and OpenID Connect implementations. Authorizing the user occurs via the user's web browser, and the request is described using instances of AuthorizationRequest. The request is dispatched using performAuthorizationRequest() on an AuthorizationService instance, and the response (an AuthorizationResponse instance) will be dispatched to the activity of your choice, expressed via an Intent. Token requests, such as obtaining a new access token using a refresh token, follow a similar pattern: TokenRequest instances are dispatched using performTokenRequest() on an AuthorizationService instance, and a TokenResponse instance is returned via a callback. Responses can be provided to the update() methods on AuthState in order to track and persist changes to the authorization state. Once in an authorized state, the performActionWithFreshTokens() method on AuthState can be used to automatically refresh access tokens as necessary before performing actions that require valid tokens.
Support
Quality
Security
License
Reuse
Top functions reviewed by kandi - BETA
- Initialize the user
- Creates a spinner for the browser
- Recreates the authorization service
- Creates an authorization service
- Read the configuration
- Get a configuration string as a string
- Returns true if redirect uri is registered
- Get a required configuration URI
- Display the token activity
- Handle the configuration
- Checks if additional parameters are supported by the builder
- Initializes the authorization state
- Performs the authentication request
- Get the browser view
- Binds the custom tabs to the browser
- Initializes the application auth service
- Fetch information about the user
- Region UserInfo
- Starts the authorization process
- Store the authorization information
- Handles a registration response
- Open a connection to the given URI
- Returns the URI for this endpoint
- Derives a challenge from a string
- Returns the request parameters for this request
- Read a string from an input stream
AppAuth-Android Key Features
AppAuth-Android Examples and Code Snippets
License : Strong Copyleft (CC BY-SA 4.0)
Copyconst config = {
accessTokenUrl: `https://${DOMAIN}/oauth2/token`,
profileUrl: `https://${DOMAIN}/oauth2/userInfo`,
authorizationUrl: `https://${DOMAIN}/oauth2/authorize`,
// redirect_uri: 'https://example.com',
clientId: myAWScldocker_compose:
project_name: appauth
restarted: true
pull: yes
definition:
version: '2'
services:
keycloak:
image: jboss/keycloak:8.0.1
container_name: keycloak
restart: always
environment:
- DB_VENimport * as AppAuth from 'expo-app-auth';
const result = await Google.logInAsync({
androidStandaloneAppClientId: 'myKey,
iosStandaloneAppClientId: 'myKey,
scopes: ['profile', 'email'],
behavior: 'web',
redirectUrl: `${AppAuth.OA CFBundleURLTypes
CFBundleTypeRole
Editor
CFBundleURLName
ab032846-efee-481f-b6bc-493aae92c432
CFBundleURLSchemes
app-auth
Community Discussions
Trending Discussions on AppAuth-Android
QUESTION
I'm trying to authenticate to OpenStreetMap via OAuth2 using AppAuth. Via Custom Tab I can retrieve the authorization code but the redirect URI does not open my app but gives an Address Not Found error in the Custom Tab. As you can see as I was experimenting around to solve this issue I used app.example.com as host name, although the package name is com.example.app, but even if I do use the package name as host name in the redirect URI (and change this in the manifest, gradle, osm etc.), it still does not work but results in an Invalid Redirect URI error. So I would assume something with the redirect URI isn't quite right, but I cannot figure out what it is.
Also I cannot use a custom scheme, as OSM only accepts https redirect URIs.
MainActivity.java:
...ANSWER
Answered 2022-Mar-06 at 22:42Using HTTP redirect URIs requires these settings in the build.gradle file, and also has a prerequisite of app link registration via a hosted assetlinks.json file:
QUESTION
I am using a third-party identity provider (Ping Identity). I have configured the client_id, redirect_uri and discovery_uri in my OpenID connect client library (https://github.com/openid/AppAuth-Android).
I was able to successfully log in and got access_token and refresh_token.
I am trying to embed some info in the access_token. But to encode i need the private key.
Question
I was wondering if there is an API that can be called with the help of the library that will encode it for me by calling the identity provider.
Thanks in advance :)
...ANSWER
Answered 2022-Feb-21 at 14:02If custom claims are needed in access tokens, then they are usually included at the time of token issuance. Eg Ping Federate could make a JDBC connection to do this.
If you are using an External IDP with no relationship to your data, then perhaps this is not possible. That is why the recommendation is to avoid using foreign access tokens. Note also that access tokens are only intended for APIs and it is recommended to avoid reading them directly in web or mobile clients.
The usual technique is for the data owner to issue their own tokens after validating the external tokens, and adding any custom data / claims needed. Ideally use an Authorization Server for this, or perhaps your own API that acts as a token service, and which can store the token signing private key securely.
QUESTION
when I use this library: https://github.com/openid/AppAuth-Android
have an issue when trying to use the deep link and open application. in this case, I have a multi-instance of my app with the same name and package name. I want to just one instance. (when I touch in one of the instances redirect happen but when touching the other one nothing happen)
everything works perfectly good and only I have this issue. I saw these issues too:
https://github.com/openid/AppAuth-Android/issues/329
https://github.com/openid/AppAuth-Android/issues/481
https://github.com/openid/AppAuth-Android/issues/491
and this is my code inside manifest:
...ANSWER
Answered 2021-Jun-09 at 10:27we found the solution. we have to just add
QUESTION
I am using AppAuth library for Android to connect to an OIDC server which is not from the list of well known vendors like Okta, Google, etc.
This vendor does not support custom url schemas. It only supports https redirects.
I configured my app based on the documentation and sample app from AppAuth-Android github repo.
I have added the AppLink activity from the library in my AndroidManifest file:
...ANSWER
Answered 2021-Mar-06 at 20:25This is a browser specific issue - due to a missing user gesture in the Chrome Custom Tab on the second login attempt - and may be intermittent.
It is a nuance of using claimed HTTPS schemes, and the same problem exists on iOS. The solution is to use an interstitial web page so that there is a user gesture on every redirect, and so that return to the app is deterministic.
RESOURCES OF MINE
You should be able to just clone the below repo and run the sample on your PC, for something to compare against. The blog posts describe the issues in more depth.
QUESTION
I'm trying to understand - what is the use of AppAuth SDK really? I have a website (which acts as the User Agent in OAuth2.0) where the user inserts his credentials. I pass this website a Redirect URL as a parameter, and once the user passes the verification process inside the website, the website sends the redirect url along with an Access Token.
Now if I'm not mistaken I have a few options :
- WebView - simply catching the
shouldOverrideUrlLoadingcallback, and retrieving the access token from the url. What are the cons of this approach? - doing the same with Chrome Custom Tabs ?
- doing the same with Trusted Web Activity ?
- Integrating the AppAuth SDK somehow, but what does it really give us that the former approaches don't do or don't handle?
Does it handle the fact that I need a Digital Asset Link maybe ? Do I even really need it?
...ANSWER
Answered 2020-Jul-02 at 08:04AppAuth is just a library which has few pre defined methods which are quite common for any OAuth provider. For example Microsoft uses MSAL which is based on AppAuth and helps in authenticating a user and getting the access token.
However you can definitely make your own implementation without using AppAuth. You can have a ChromeCustomTab open and listen to redirect URL.
e.g.
QUESTION
I need help.
I am using AppAuth-Android in my app to handle the oAuth flow. When the flow starts, I call the startActivityForResults method as described in the https://github.com/openid/AppAuth-Android#obtaining-an-authorization-code step. After calling this method, the browser pops up waiting for the user login.
In my manifest I have
...ANSWER
Answered 2020-Jun-10 at 18:57I assume the intent-filter you posted is set for RedirectUriReceiverActivity, but you can actually have your own Activity instead to be the man-in-the-middle. If you look into the source code it basically does nothing more than
Community Discussions, Code Snippets contain sources that include Stack Exchange Network
Vulnerabilities
No vulnerabilities reported
Install AppAuth-Android
Support
Reuse Trending Solutions
Find, review, and download reusable Libraries, Code Snippets, Cloud APIs from over 650 million Knowledge Items
Find more librariesStay Updated
Subscribe to our newsletter for trending solutions and developer bootcamps
Share this Page
