Auth0 Swift SDK .authentication().login returning invalid token

Question

I recently began a new project that uses Auth0 in which I am adding an iOS app to an existing web app project. The web app uses a machine to machine Auth0 app and we have added a Auth0 native app to handle the iOS authentication.

Everything is working as expected if I use the .webauth() call. The webauth returns a valid token and through breakpoints I have followed the code to see that it goes through the PKCE process.

The issue I am wondering about is if it is possible to use the Swift SDK and .authentication().login to get a valid token so I can create a custom login page. The designers requirements are such that custom is what we need.

Currently if I just use the .authentication().login call it returns an invalid token. I can see that this flow does not follow PKCE protocol and returns a token whose header says it is signed with RS256 when in reality it is signed with HS256.

I see where I can implement a PKCE authentication through RESTful calls(and using a webview...) but I would think it would be possible with the swift SDK provided. Any hints or help would be greatly appreciated.

Using Auth0.Swift 1.2.2, Xcode 10 beta, ios 11, swift 4.

The webauth call:

Auth0
   .webAuth()
   .connection("MY-CONNECTION)
   .audience("https://myapp.auth0.com/userinfo")
   .start { result in
        switch result {
        case .success(let credentials):
            print("credentials: \(credentials)")
        case .failure(let error):
            print(error)
         }
     }

The authentication() call:

 Auth0
    .authentication()
    .login(
        usernameOrEmail: "me@mycompany.com",
        password: "password",
        realm: "MY-CONNECTION",
        audience: "https://myapp.auth0.com/userinfo",
        scope: "openid")
    .start { result in
        switch result {
        case .success(let credentials):
            print("Obtained credentials: \(credentials)")
        case .failure(let error):
            print("Failed with \(error)")
        }
}

Thank you,

ben

Answer 1

It has been pointed out to me that creating a custom Auth0 login basically goes against the security that Auth0 is trying to provide. It takes the handling of usernames and passwords out of Auth0's hands and puts them back into being handled by the creator of the app.

So, custom logins are not supposed to be part of the design. And despite it's lack of customizability I will be implementing the .lock login flow to keep from having to use a web login in my app.

Just want to put this here in case someone else ends up in my situation.