Stored credential is lost upon app restart

zdtorok

I am using OAuth user authentication and when the user have authenticated successfully, I store their credential in the `arcGISCredentialStore`.

Something like this:

let oAuthUserConfig = OAuthUserConfiguration(portalURL: portalUrl, clientID: authConfig.clientId, redirectURL: redirectUrl)
ArcGISEnvironment.authenticationManager.arcGISAuthenticationChallengeHandler = EsriChallengeHandler(oAuthUserConfigurations: [oAuthUserConfig])

Task {
    do {
        let oAuthUserCredential = try await OAuthUserCredential.credential(for: oAuthUserConfig)
        ArcGISEnvironment.authenticationManager.arcGISCredentialStore.add(oAuthUserCredential)
    } catch {
        print(" >> Error obtaining OAuthUserCredential: \(error)")
    }
}

My problem is that after the user is authenticated, the credentials are stored in the credential store properly but when I restart the app, the credential store is empty and it triggers for authentication again.

Am I doing something wrong or is there maybe a bug? I'm using 200.4.0.

FYI This is the challenge handler:

@MainActor
final class EsriChallengeHandler: ArcGISAuthenticationChallengeHandler {
    let oAuthUserConfigurations: [OAuthUserConfiguration]
    
    public init(oAuthUserConfigurations: [OAuthUserConfiguration] = []) {
        self.oAuthUserConfigurations = oAuthUserConfigurations
    }

    func handleArcGISAuthenticationChallenge(_ challenge: ArcGISAuthenticationChallenge) async throws -> ArcGISAuthenticationChallenge.Disposition {
        if let configuration = oAuthUserConfigurations.first(where: { $0.canBeUsed(for: challenge.requestURL) }) {
            do {
                let credential = try await OAuthUserCredential.credential(for: configuration)
                ArcGISEnvironment.authenticationManager.arcGISCredentialStore.add(credential)
                return .continueWithCredential(credential)
            } catch {
                return .cancel
            }
        }

        print("No matching configuration found for challenge")
        return .cancel
    }
}

 Thank you.

NimeshJarecha

Hi @zdtorok,

To build your understanding of how secured resources work, let's go through the process step-by-step.

Creating credentials does not trigger an authentication challenge in your EsriChallengeHandler. Therefore, you should remove the following code:

 

Task {
    do {
        let oAuthUserCredential = try await OAuthUserCredential.credential(for: oAuthUserConfig)
    } catch {
        print(" >> Error obtaining OAuthUserCredential: \(error)")
    }
}

 

 

An authentication challenge is issued when accessing secured resources such as a portal, portal item, or layer. You create a credential to fulfill this authentication challenge. The credentials provided during the challenge are added to the credential store by the SDK, so subsequent requests from the same source URL will reuse them. Here is the workflow you should try:

1. Set Persistent Credential Store and Challenge Handler: At the start of the application, set the persistent credential store and challenge handler on ArcGISEnvironment.authenticationManager.

 

let oAuthUserConfig = OAuthUserConfiguration(portalURL: portalUrl, clientID: authConfig.clientId, redirectURL: redirectUrl)
ArcGISEnvironment.authenticationManager.arcGISAuthenticationChallengeHandler = EsriChallengeHandler(oAuthUserConfigurations: [oAuthUserConfig])
ArcGISEnvironment.authenticationManager.arcGISCredentialStore = try await .makePersistent(access: .afterFirstUnlockThisDeviceOnly, synchronizesWithiCloud: true)

 

 

2. Create and Load a Portal: Create and load a portal, which should issue an authentication challenge.

 

let portal = Portal(url: portalUrl, connection: .authenticated)
try await portal.load()

 

 

3. Credential Storage: The portal is loaded using the provided credential from the authentication challenge, and the credential is stored. The credential creation shows you the login view to enter the username and password.

4. App Restart: Close and re-open the app, which will reinitialize the challenge handler and persistent store.

5. Credential Retrieval: When the persistent store is set, the SDK loads credentials from the keychain into the credential store. You should see the credential available in the store.

6. Portal Loading: The app will attempt to load the portal again. It will find the credential in the store and reuse it, allowing the portal to load without issuing a new authentication challenge.

 

I would recommend using Authenticator toolkit component which takes care of showing user interface for different authentication types and handle all the complexity. You can look at this example to know see how challenge handlers and persistent credential stores are setup.  

 

Hope this helps!

Regards,

Nimesh