We have an SSO application that provides authentication for a native mobile application, as well as for a web application. There are some features that the web application has that the mobile application does not, such as account management. We would like to keep the user logged in (without having to sign in again) when directing them from the app to the web browser, let's say via a settings button click in the native application.
What is the recommended approach to carry along the mobile application's session to the web browser?
Some clarifying points:
- The native mobile application authenticates via the resource-owner flow, as described in RFC 6749
- The web application authenticates via the standard shared web UIs