Make a token exchange authorization request with AppAuth-Android but NOT with customtabs
So, the entire premise of this question might be dumb and therefore moot, but here goes:
I have a custom IdP with a way to exchange oauth1 token+secret for OIDC Tokens. Its effectively a silent authorization request to switch already logged in apps from old system to the new. This all functions.
However, using custom tab to perform the request means it pops up the browser. When doing this on phones without chrome installed, the browser often do not even close itself as chrome custom tabs does after the request goes through. I would like to avoid this entirely by NOT using custom tabs to perform the request.
So, I used okhttp to perform the request. okhttp does not handle redirects to uris, so on response, I:
if (response.isRedirect()){
Intent intent = new Intent(Intent.ACTION_VIEW,
Uri.parse(response.headers().get("location")));
startActivity(intent);
}
This gets the intent to net.openid.appauth.RedirectUriReceiverActivity, however it now needs to check AuthorizationRequest request = PendingIntentStore.getInstance().getOriginalRequest(state);, and I cannot set the original request to the PendingIntentStore as it is not accessible in my custom performSilentAuthorizationRequest.
Should I clone AppAuth-Android just to hack in access to PendingIntentStore? I suppose I can also extend RedirectUriReceiverActivity and change it to use a stand-alone copy of PendingIntentStore that I can access. But effectively that's the same thing, just circumventing RedirectUriReceiverActivity's PendingIntentStore check.
All of this was started to prevent an ugly UI situation wherein the browser is unnecessarily popped up. So any suggestion that circumvent that would be welcome.
android appauth
asked Nov 16 '18 at 16:37
Miao Liu
37519
add a comment |
So, the entire premise of this question might be dumb and therefore moot, but here goes:
I have a custom IdP with a way to exchange oauth1 token+secret for OIDC Tokens. Its effectively a silent authorization request to switch already logged in apps from old system to the new. This all functions.
However, using custom tab to perform the request means it pops up the browser. When doing this on phones without chrome installed, the browser often do not even close itself as chrome custom tabs does after the request goes through. I would like to avoid this entirely by NOT using custom tabs to perform the request.
So, I used okhttp to perform the request. okhttp does not handle redirects to uris, so on response, I:
if (response.isRedirect()){
Intent intent = new Intent(Intent.ACTION_VIEW,
Uri.parse(response.headers().get("location")));
startActivity(intent);
}
This gets the intent to net.openid.appauth.RedirectUriReceiverActivity, however it now needs to check AuthorizationRequest request = PendingIntentStore.getInstance().getOriginalRequest(state);, and I cannot set the original request to the PendingIntentStore as it is not accessible in my custom performSilentAuthorizationRequest.
Should I clone AppAuth-Android just to hack in access to PendingIntentStore? I suppose I can also extend RedirectUriReceiverActivity and change it to use a stand-alone copy of PendingIntentStore that I can access. But effectively that's the same thing, just circumventing RedirectUriReceiverActivity's PendingIntentStore check.
All of this was started to prevent an ugly UI situation wherein the browser is unnecessarily popped up. So any suggestion that circumvent that would be welcome.
android appauth
asked Nov 16 '18 at 16:37
Miao Liu
37519
add a comment |
So, the entire premise of this question might be dumb and therefore moot, but here goes:
I have a custom IdP with a way to exchange oauth1 token+secret for OIDC Tokens. Its effectively a silent authorization request to switch already logged in apps from old system to the new. This all functions.
However, using custom tab to perform the request means it pops up the browser. When doing this on phones without chrome installed, the browser often do not even close itself as chrome custom tabs does after the request goes through. I would like to avoid this entirely by NOT using custom tabs to perform the request.
So, I used okhttp to perform the request. okhttp does not handle redirects to uris, so on response, I:
if (response.isRedirect()){
Intent intent = new Intent(Intent.ACTION_VIEW,
Uri.parse(response.headers().get("location")));
startActivity(intent);
}
This gets the intent to net.openid.appauth.RedirectUriReceiverActivity, however it now needs to check AuthorizationRequest request = PendingIntentStore.getInstance().getOriginalRequest(state);, and I cannot set the original request to the PendingIntentStore as it is not accessible in my custom performSilentAuthorizationRequest.
Should I clone AppAuth-Android just to hack in access to PendingIntentStore? I suppose I can also extend RedirectUriReceiverActivity and change it to use a stand-alone copy of PendingIntentStore that I can access. But effectively that's the same thing, just circumventing RedirectUriReceiverActivity's PendingIntentStore check.
All of this was started to prevent an ugly UI situation wherein the browser is unnecessarily popped up. So any suggestion that circumvent that would be welcome.
android appauth
asked Nov 16 '18 at 16:37
Miao Liu
37519
So, the entire premise of this question might be dumb and therefore moot, but here goes:
I have a custom IdP with a way to exchange oauth1 token+secret for OIDC Tokens. Its effectively a silent authorization request to switch already logged in apps from old system to the new. This all functions.
However, using custom tab to perform the request means it pops up the browser. When doing this on phones without chrome installed, the browser often do not even close itself as chrome custom tabs does after the request goes through. I would like to avoid this entirely by NOT using custom tabs to perform the request.
So, I used okhttp to perform the request. okhttp does not handle redirects to uris, so on response, I:
if (response.isRedirect()){
Intent intent = new Intent(Intent.ACTION_VIEW,
Uri.parse(response.headers().get("location")));
startActivity(intent);
}
This gets the intent to net.openid.appauth.RedirectUriReceiverActivity, however it now needs to check AuthorizationRequest request = PendingIntentStore.getInstance().getOriginalRequest(state);, and I cannot set the original request to the PendingIntentStore as it is not accessible in my custom performSilentAuthorizationRequest.
Should I clone AppAuth-Android just to hack in access to PendingIntentStore? I suppose I can also extend RedirectUriReceiverActivity and change it to use a stand-alone copy of PendingIntentStore that I can access. But effectively that's the same thing, just circumventing RedirectUriReceiverActivity's PendingIntentStore check.
All of this was started to prevent an ugly UI situation wherein the browser is unnecessarily popped up. So any suggestion that circumvent that would be welcome.
android appauth
android appauth
asked Nov 16 '18 at 16:37
Miao Liu
37519
asked Nov 16 '18 at 16:37
Miao Liu
37519
asked Nov 16 '18 at 16:37
Miao Liu
37519
asked Nov 16 '18 at 16:37
Miao Liu
37519
asked Nov 16 '18 at 16:37
Miao Liu
37519
37519
add a comment |
add a comment |
active
oldest
votes
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53342007%2fmake-a-token-exchange-authorization-request-with-appauth-android-but-not-with-cu%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53342007%2fmake-a-token-exchange-authorization-request-with-appauth-android-but-not-with-cu%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
