适用于应用的 Android SSO（单点登录）

Question

Is there any free single-signon mechanism for Android that gracefully works with non-webapps? Say, something along the lines of...

1. You launch my app and use it until it makes a request from the app server that requires authentication. It responds to that request with a random token that the server will associate with you for a short time.

2. The app presents you with a username field, a password field, and a submit button.

3. You enter your username and password. The app then forwards your username and hashed password, along with the token generated by the app server, to the login service.

4. The login service determines whether or not your username and password are valid. If they are, it digitally timestamps and signs the token, and returns the signed token to the app.

5. The app relays the signed token to the server.

6. The server checks the signature, satisfies itself that it's valid and signed by an authority it trusts, and proceeds as though the user had presented IT with a valid local username and password instead.

I suspect I'm just getting lost in nomenclature, but the impression I've gotten so far is that all the usual SSO providers -- Twitter, Facebook, etc -- only allow users to log in using a normal browser, and that you're either not allowed to do what I described, or they do something to make it effectively impossible with anything besides a normal browser (like dynamically creating the login form via Javascript in an effort to prevent developers from trying to use their own apps as a login facade).

Alternatively, does there exist any workflow like THIS...

1. You launch my app and use it until the web service requires you to log in. The app server generates a token and returns it to the app.

2. The app spawns a new browser via intent that sends you to the login provider's web site, passing the token via intent to the browser (and ultimately the provider) as a POSTed formvar.

3. You log in using the browser window, and the browser window closes -- returning you to my app.

4. The login provider signs the token, then sends it directly to my app server via HTTP POST so I can note its submission, verify the cert, and treat it as though it were instead a valid username and password submitted directly by the user to the app server himself.

Answer 1

Have you tried or think of using Firebase? https://firebase.google.com/docs/auth/?hl=es-419

It has some useful tools, you can sign-in with multiple social connectors and user/password as well, and they provide a library to integrate the whole UI and server flow, they even take advantage of google smart lock for you.

Take a look at https://github.com/firebase/FirebaseUI-Android I used it in a personal project and saved me a lot of time.

Answer 2

What you described in Alternatively section looks like Authorization Code using Proof Key for Code Exchange (PKCE) OAuth 2.0 grant

https://www.rfc-editor.org/rfc/rfc7636

The flow is the following:

1. Your app generates a random key ( code_verifier ) and it's transformed value ( code_challenge ) and navigates to authorization server with code_challenge as a parameter
2. Authorization server redirects back to your app with authorization code
3. Your app sends authorization_code and the code_verifier to the auth server to get the authorization token
4. Server uses authorization_code and the code_verifier (it already has code_challenge , so it can verify that code_verifier is correct) and then returns to your app with the token.

On the practical side of it you can use something like Auth0 to implement it in your app.

Answer 3

Use Android Account Manager for SSO.

Providing references below just for knowledge. You have to dig into account manager.
Android developer: https://developer.android.com/training/id-auth
Blog with example: https://www.zoftino.com/android-account-manager-&-create-custom-account-type