Add support for other browsers on iOS

[WilliamDenniss]

To support "enterprisy" use-cases like those encountered by the NCCoE's Mobile SSO effort, it would be useful to include support to process the OAuth request in alternative user-agents on iOS such as Chrome and Firefox.

These external user-agents may support additional features like U2F which are required by some enterprise environments.

This feature would be specifically for environments where you can control what apps users have installed (such as an enterprise workplace). Consumer apps should continue to use the existing in-built external user-agents (i.e. the various incarnations of Safari) supported by AppAuth.

AppAuth already abstracts away the UICoordinator to handle requests in the user-agent to support browsers on different platforms, so this functionality could simply be provided as an alternative implementation UICoordinator on iOS.

[WilliamDenniss]

This has been implemented. Here's how to configure AppAuth to use a custom browser:

First, add the following array to your Info.plist (in XCode, right click -> Open As -> Source Code)

	<key>LSApplicationQueriesSchemes</key>
	<array>
		<string>googlechromes</string>
		<string>opera-https</string>
		<string>firefox</string>
	</array>

This is required so that AppAuth can test for the browser and open the app store if it's not installed. You only need to include the URL scheme of the browser you intend to use.

Then tweak your call to authStateByPresentingAuthorizationRequest

AppAuth-iOS/Examples/Example-iOS_ObjC/Source/AppAuthExampleViewController.m

Lines 215 to 218 in 135f99d

	appDelegate.currentAuthorizationFlow =
	[OIDAuthState authStateByPresentingAuthorizationRequest:request
	presentingViewController:self
	callback:^(OIDAuthState *_Nullable authState, NSError *_Nullable error) {

Change it to:

  OIDExternalUserAgentIOSCustomBrowser *externalUserAgent =
      [OIDExternalUserAgentIOSCustomBrowser CustomBrowserChrome];
  appDelegate.currentAuthorizationFlow =
   [OIDAuthState authStateByPresentingAuthorizationRequest:request
                                         externalUserAgent:externalUserAgent
                                                callback:^(OIDAuthState *_Nullable authState, NSError *_Nullable error) 

As you can see, with the latter code block we are creating the external user-agent object manually and using it, rather than using the default. This technique can be used with the automatic code exchange of OIDAuthState (as shown above), and manually with OIDAuthorizationService:presentAuthorizationRequest:externalUserAgent:callback:.

That's it! With those two changes (which you can try on the included sample), AppAuth will use Chrome iOS for the authorization request (and open Chrome in the App Store if it's not installed).

⚠️Note: this feature is not intended for consumer apps. It is designed for advanced enterprise use-cases where the app developers have greater control over the operating environment and have special requirements that require a custom browser like Chrome.

Chrome, Firefox, Opera Mini and Safari are supported out of the box, however it's quite simple to support more browsers without changes to AppAuth, by following the patterns used for the included browsers.

Update 2018-03-07: This post was edited to reflect the recent renaming of UICoordinator to ExternalUserAgent.

[tomjackman]

@WilliamDenniss Mind adding how-to notes to the main Readme? It's not really visible that this feature exists there.

[WilliamDenniss]

In due course. This only just landed in HEAD, needs an example too ideally.

[sattaman]

Will this change also allow consumer apps to login without SSO ?

[WilliamDenniss]

@sattaman not directly, but a similar pattern could achieve that. Let's continue that discussion in #209 rather than here.

[munderk]

Working with safari but not with chrome..

[WilliamDenniss]

@munderk please file a bug report if you're experiencing an issue.

[WilliamDenniss]

For the record, I just tested AppAuth's custom browser support with Chrome (v67.0.3396.87) on iOS 11.4.1, following these instructions, and everything worked as expected.