1

We have an SSO application that provides authentication for a native mobile application, as well as for a web application. There are some features that the web application has that the mobile application does not, such as account management. We would like to keep the user logged in (without having to sign in again) when directing them from the app to the web browser, let's say via a settings button click in the native application.

What is the recommended approach to carry along the mobile application's session to the web browser?

Some clarifying points:

Improve this question
3
  • Can you simply allow your users to be logged in two places at once?
    – Robert Harvey
    May 22, 2020 at 0:42
  • The problem isn't allowing them to be logged in to both - it's how to allow them to access the web without having to log in again. It's a UX problem mostly.
    – John Leehey
    May 22, 2020 at 4:23
  • do you use any specific service for authentication? Cognito? 0Auth? or is it your custom authentication service?
    – Kamil Janowski
    May 22, 2020 at 7:50

2 Answers 2

Reset to default
3

AFAIK there is no standard way of handling this kind of situation. However, if you do have access to the backend code (most of the off-the-shelf authentication solutions allow you to provide a serverless function extending the capabilities of the server), you could implement something similar to OAuth2 Authorization Code Grant.

  1. An authenticated application requests a code from the authentication server (a 1 time use code that is valid only for another 2 minutes or so)
  2. Start the website along with that code in the URL
  3. The web application contacts the authentication server in order to exchange the code for an authentication token (like JWT or whatever you're using)
Improve this answer
0

If the user has just signed in to the sso provider they may still have an active session.

When I've used OIDC in the past, if the user has an active session and assuming the Web application uses the same client ID and doesn't request any new scopes, the auth service will simply redirect the user back to the app with a token.

If the user doesn't have an active session on the SSO provider it might make sense to authenticate them again anyway, I wouldn't want anyone being able to change my settings without a proper logged in session.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.