[walt]

I have an app that requires a user to identify themselves to a server to retrieve info. The server is using Microsoft Azure Access control services.

The process is as follows:

1. user clicks login button in app.
2. App uses a http request to get a login url from the relying service hosted on azure
3. app takes user to that url which is a login screen for one of the available identity service providers google/facebook/windows live/ect
4. User enters login info and submits.
5. Identity service provider returns authentication token via window.external.notify() method.

This is where my app fails in the emulator and on the phone. It seems that the window.external.notify method does not work with either browser. I found some background and a possible solution to the issue here: http://www.stevesaxon.me/posts/2011/window-external-notify-in-ios-uiwebview/.

This solution though seems fairly complex and seems designed for a native app. Before I dig in to understanding it, I want to see if there are any mobiOne suggestions on one of the following possible workarounds:

1. add a window.external.notify() method in custom javascript?
2. Get the identity provider to return the token without the window.external.notify method?
3. Utilize the identity provider without the browser (submitting the login info as a http request or something)?
3. Use some other user authorization method?

I welcome any and all suggestions — I anticipate this is an issue that will come up again so I would prefer to find the best possible solution.

thanks!

[Brandon]

I have used php to do a login for an admin screen where the user can edit the app contents. This just requires submitting the login info using the form property on the page. Not too hard and it works well.

[walt]

cincy thanks for the reply.

Unfortunately this app needs to support a pretty specific user authentication process where the user logs in to something like google or facebook and the app gets an id token to use to identify the user on a microsoft azure web service. The process is managed by microsoft access control service.

Looking around apps and the web, seems like this outsourced or single sign in authentication is where things are headed. I will post an update on how things work out. If anyone has a suggestion — particularly regarding how to handle window.external.notify() it would be a great help!

[support-michael]

@walt

>Unfortunately this app needs to support a pretty specific user authentication process where the user logs in to something like google or facebook and the app gets an id token to use to identify the user on a microsoft azure web service.

I assume you are referring to OAuth?
We are researching this now and will provide feedback asap.

[walt]

Hi Wayne,

Thanks for the reply. I have set up a mobione app that attempts authorization from an test microsoft access control service. Is there a way I can email you the project and accompanying documentation? It is work for a client so I can’t post it.

[walt]

This link demonstrates the desired functionality in a windows 7 phone project:

http://acs.codeplex.com/wikipage?title=ACS%20Windows%20Phone%20Sample

[walt]

Hi Wayne,
Although, my client prefers the authentication process follow the active scenario using window.external.notify, I think the passive redirect scenario would also work. I found an example using the phonegap childbrowser, openid and facebook. The process in this example should work if I could set a location change function for the popup browser like below:

window.plugins.childBrowser.onLocationChange = function(loc){self.onLocationChange(loc);};

Can I set that in my custom javascript file?

FBConnect.prototype.connect = function(client_id,redirect_uri,display)
{
    this.client_id = client_id;
    this.redirect_uri = redirect_uri;
    
    var authorize_url  = "https://graph.facebook.com/oauth/authorize?";
        authorize_url += "client_id=" + client_id;
        authorize_url += "&redirect_uri=" + redirect_uri;
        authorize_url += "&display="+ ( display ? display : "touch" );
        authorize_url += "&type=user_agent";

    window.plugins.childBrowser.showWebPage(authorize_url);
    var self = this;
    window.plugins.childBrowser.onLocationChange = function(loc){self.onLocationChange(loc);};
}

FBConnect.prototype.onLocationChange = function(newLoc)
{
    if(newLoc.indexOf(this.redirect_uri) == 0)
    {
        var result = unescape(newLoc).split("#")[1];
        result = unescape(result);
        
        // TODO: Error Check
        this.accessToken = result.split("&")[0].split("=")[1];        
        //this.expiresIn = result.split("&")[1].split("=")[1];
    
        window.plugins.childBrowser.close();
        this.onConnect();
    }
}

FBConnect.prototype.getFriends = function()
{
    var url = "https://graph.facebook.com/me/friends?access_token=" + this.accessToken;
    var req = new XMLHttpRequest();
    
    req.open("get",url,true);
    req.send(null);
    req.onerror = function(){alert("Error");};
    return req;
}

[support-octavio]

Hi walt,

We are evaluating this and will provide feedback tomorrow.

[walt]

thanks for the update.

[walt]

Hi Octavio,

I really appreciate the effort you guys are putting into figuring this out.

If at all possible, please let me know where this is at (i.e. likelihood of a solution within MobiOne) by end of day. A decision is being made whether we need change gears for this project in the am.

thanks again,
walt

[support-michael]

@walt

Based on our current work load I honestly don’t see us getting too far on this today. We were able to get a developer to review and provide some preliminary input. He was positive that this is doable. But this is very preliminary.

[walt]

thanks for the reply, that is helpful to know.

[walt]

Hi Wayne, have you guys found any time to look more closely at the federated authentication question?

I got it basically working in x-code with cordova(phonegap) and the childbrowser plugin, but that is definitely not an ideal solution since much of the benefit of using mobione goes out the window if we are bringing projects back into x-code to add the login component. Is there any way for a user to extend or modify the browser popup in mobione? How about just adding an event listener to catch the redirect url after login?

thanks for the help!

[support-michael]

@walt

Sorry didn’t make any more progress than a team discussion for a similar solution as you describe. What we can say is the Cordova childbrowser is used to implement the GotoURL(popup) action. Thus you can directly access the Cordova/PG childbrowser as you choose.

example:
window.plugins.childBrowser.locationChanged = function(newLoc) { … };

The Test Center emulator does not emulate the cordova/phonegap api. Thus you need to test in on a device. If you are familiar with weiner give debug.phonegap.com a look for on device testing using the webkit inspector from Chrome or Safari (I have only used Chrome).

[walt]

Thanks for the reply wayne, that is good news.

I was hoping there was a way to catch the location change in mobione. Now if I can just convince some folks that we don’t need the window.external.notify callback I will be able to avoid xcode for the rest of this project!

[Author]

Posts