Hey all! My team and I have been looking into possible ways to integrate our [future] Discourse instance into our mobile application - Noom. Our iOS app is written in Objective-C with some Swift, and our Android application is written in Java with some Kotlin. We’ve been debating between full integration via API or web view as our goal is an SSO flow where our users can seamlessly transition from an in-app experience to our Discourse instance. I’m currently waiting on our QA team to get back to me on which authentication protocols we currently use, but I was curious as to anyone else’s experience integrating Discourse into a mobile application with or without SSO, and what methods (if any) you found most useful throughout the process. I’m aware of Discourse’s compatibility with OAuth/2, although not aware of other potential protocols. My apologies if this is in the wrong category!

There is a new way of authentication. However the documentation is yet to be released. [image] Delegated authentication for Discourse Mobile app Development Originally when we built the mobile app Apple offered seamless embedding of Safari in mobile apps. All was good, you could log in to Safari, and magically with one click have the application authenticated. However, fast forward a few years and Apple released iOS 11. Sadly, this broke “shared cookies”, this meant that you had to log in to the application web sites AGAIN after already being logged in, in Safari. To add additional layers of pain crying_cat_face , cookie management in Safari Vi…

I’m going to update the documentation about delegated authentication soon, but I can give you some pointers right here. First you need to open a browser session to discourse.site/user-api-key/new with the following parameters: scopes: 'notifications,session_info,one_time_password', client_id: YOUR_APP_CLIENT_ID, nonce: GENERATED_NONCE, auth_redirect: YOUR_APP_URL_SCHEME, application_name: YOUR_APP_NAME, push_url: PUSH_URL (if you are going to send PNs from Discourse to your app), public_key: PUBLIC_KEY (generated in your app) You can have a look at the implementation of our DiscourseMobile app for details on the above but the main idea is that your app will launch a browser screen to the URL above, asking the user to authenticate to the Discourse site and authorize your app access to it. Once user authorizes access, Discourse will redirect to YOUR_APP_URL_SCHEME?payload= with an encrypted payload. You’ll need to set up your app to decrypt the payload and store the authToken. In iOS, you should use ASWebAuthenticationSession | Apple Developer Documentation (I don’t know if there is an Android equivalent). Your authToken can make API requests limited by the scopes requested initially, for a full list of scopes, please look under allow user api key scopes in site settings. The one_time_password scope allows the authToken to make a request for a one-time-password. The endpoint for this is /user-api-key/otp with the parameters auth_redirect, application_name and public_key. I will write a proper documentation shortly, but this should help you get started.

@hosna + @pmusaraj Thank you both! I will pass this information along to our QA director.

[image] pmusaraj: I will write a proper documentation shortly, but this should help you get started. @pmusaraj hey, is there already any official documentation available to the public? I’d love to dig deeper.

I’m going to tackle this exact thing over the next few days, I will update on my success or failure. If anyone has any guides or pointers I’d welcome them :slight_smile:

I think you’re looking for User API keys specification and specifically the section " API key generation flow".

Hey Penar, thanks for the guidance, I’m far from an expect in this stuff, I havent done much with any cryptography, or apis like this before and was wondering if you could provide some help as to how to encode some of these parameters? I’m looking at your DiscourseMobile app but I have never used JS before, so I’m having a few difficulties. nonce and client_id - Are these just random 16 and 32 byte strings hex encoded? public_key - Any guidance on how to generate this? I’m trying to use the resource here which would leave me with a SecKeyRef, am I to convert this to NSData and then UTF8 encode? Wouldn’t happen to have any snippets in swift or objective c would you? I’ll figure this out, its just all new to me so any bit of help is appreciated.

[image] xceph: nonce and client_id - Are these just random 16 and 32 byte strings hex encoded? public_key - Any guidance on how to generate this? I’m trying to use the resource here which would leave me with a SecKeyRef, am I to convert this to NSData and then UTF8 encode? nonce is a random key, see generateNonce here: DiscourseMobile/js/site_manager.js at main · discourse/DiscourseMobile · GitHub client_id is the app’s deviceToken, it is passed to the app via GitHub - react-native-push-notification/ios: React Native Push Notification API for iOS. · GitHub public_key is generated by GitHub - SamSaffron/react-native-key-pair · GitHub, that library is pretty small, and the relevant parts are in Objective C.

Hey Penar, thanks for the links very useful. I’m making progress but believe I’m formatting my public key incorrectly, how does the formatting on this look? https://myserver.com/user-api-key/new?client_id=11223344556677889900AABBCCDDEEFF11223344556677889900AABBCCDDEEFF&nonce=11223344556677889900AABBCCDDEEFF&application_name=AppName&public_key=-----BEGIN%20PUBLIC%20KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtoNwaYpbUcX1vqxPkxRA%0D1EyfLPxkKL6zgx4Fkk9zkYbTPTWQFuqy+O1EJtVnsW+Tx8iarFLI+ypghcx22nI0%0DN/hDFYsaT/xri+LLDc790uf2UtyolgBJfkyjJDxIXXy0pdpi6f2dgKMN2holDkxf%0DTUUnZad+wE8gT8IciX1XjU97MOngSV+IDeKPLomTuTiI1Z0hJe4WDww5+53ci4o4%0DoE5A79H/Fz/QY8vDLTcBNrQ6OdJYsRqhE5M+1sNmxpqDKT+9NcAPY7yphxm1iLuV%0Dm7c6K/xrbZExGDQd1qHvggT2ldMJIsmQEnleMdfuaYLh8+EYt8LNQ8X86V0Jj+9C%0DmQIDAQAB-----END%20PUBLIC%20KEY-----&auth_redirect=appname://auth&scopes=notifications,session_info,one_time_password In the log console I see : OpenSSL::PKey::RSAError (Neither PUB key nor PRIV key: nested asn1 error) /var/www/discourse/app/controllers/user_api_keys_controller.rb:189:in `initialize’ Thanks

I just published a script to do this exact thing @xceph. Check Generating User API Keys for testing.

Authentication Protocol re: App Integration

Development

hosna (hosna) April 11, 2019, 6:48pm 2

There is a new way of authentication. However the documentation is yet to be released.

Topic		Replies	Views
Delegated authentication for Discourse Mobile app Development	13	3321	April 29, 2019
Automatic Login from iOS/Android app Product Support	2	4695	August 15, 2016
iOS app integration Feature	5	2480	August 21, 2015
Use discourse for SSO in a non-web app? Development	12	4961	August 5, 2022
Can I develop an mobile app then use the discourse:// scheme? Development	10	318	September 29, 2025

Authentication Protocol re: App Integration

Related topics