Native app: login with username and password

Question

I have web api, for now it uses oauth2 authorization code grant type to communicate with my native application. Web browser will be opened inside app to input username and password, open authorize page etc.
I want to implement ability to login in native app using username and password without web view because it's our official native app. It sounds like resource owner credentials grant type. But it's obviously insecure because clientid is available together with app for all. But I see it works (credentials inside app) for twitter official app and others. So I suppose they use some authorization logic not oauth2 resource owner credentials grant type for their official native apps. Any thoughts here? How to build this communication in secure way?

Answer 1

The scenario you are trying to implement is not recommended under OAuth 2.0 for Native Apps

The best current practice for authorizing users in native apps is to perform the OAuth authorization request in an external user-agent (typically the browser), rather than an embedded user-agent (such as one implemented with web-views).

So, given that you've stated you want to implement in a 'secure' way, the best practice is to redirect to the system browser rather than handling the flow within your app directly.

However, if you decide to handle things 'in app' you will need to implement a http client (user agent) as part of your app. That custom user agent in your app would then need to handle the series of requests and responses to perform the OAuth 2 flow that the system browser would normally manage. Part of this would include prompting the user for credentials which would be passed to the authorization server for authentication.

Answer 2

What you are looking for is to identify a user using their social network credentials, between your native app and your service. When you receive the token from the Identity provider, you send it along to your service. The service then "Queries" the Identity Provider to find out who this user is. Once you confirm that the token is valid, you create a Session for this user on that device.

Your Native app should use the Implicit flow. This does not require the client to store the client-ID.

Using the platform SDK you can get "native" buttons on your app's login screen. This library is downloaded from FB, Google, etc for each platform that you want to support.

Note: Your app talks to the Identity Provider using the Oauth2, and your service talks to the Identity Provider using Oauth2. The communication between your app and your service is not part of the Oauth2 spec.

Have a look at this article for an excellent summary of how this hangs together: https://oauth.net/articles/authentication/