Native sign-in method about okta-oidc-ios

[chielos24]

hi Nate @nbarbettini. We have the requirement to do native (non-browser) sign-in flow for our newly build app. Stakeholder want a seamless experience on launch of the app, it would help us greatly.

• Is this a PKCE flow?
• Does it support SSO with an webapplication?

Can we perhaps:

• help on developing this in IOS.
• share a Beta version on this?

[codal-ashahu]

Is this feature still being implemented or taken off the roadmap after this?

Remove Resource Owner Password flow support #84

We are building an App that currently uses 1.0.1 release that has singin with username and password but refresh token feature is not working on that release putting us in tight spot.

Should we wait for this feature to be implemented or go with browser based authentication with popup?

[nbarbettini]

@codal-ashahu This feature replaces #84. We weren't able to replace the Resource Owner Password flow immediately in 2.0 since we had to build a supporting library. The 2.1.0 release will include this new functionality to do native (non-browser) sign-in but without the security risk of the Resource Owner Password flow.

I'm not sure why refreshing a token isn't working for you - that should work even in 1.0.1. Sorry about that! Have you opened an issue for it?

[nbarbettini]

@IldarAbdullin-okta @olexiylebedyev-okta Did we end up deciding to model this native sign-in method like the Android one? i.e. as authenticate(sessionToken)? I seem to remember that, but it's buried in PRs 😉 I think my description in this issue is not accurate anymore, just wanted to confirm.

[codal-ashahu]

this is a possible linked issue #140

[nbarbettini]

@chielos24 Yes, we built this functionality so it's possible to create a seamless (native) sign-in experience without leaving the app.

• Is this a PKCE flow? Under the hood, yes. It uses the OpenID Connect authorization code flow just like the browser sign-in flow.

• Does it support SSO with an webapplication? No. There is a tradeoff here: signing in with a browser makes the web session available for SSO in the browser, while signing in with custom native UI does not. If you need SSO in the browser, you'll need to stick with browser sign-in.

Building it requires this library and the okta-auth-swift library. Please see our custom sign-in UI sample for a working demo.