topic Re: OAuthLoginManager in ArcGIS Runtime SDK for Android Questions

OAuthLoginManager

Anonymous User — Fri, 10 May 2019 20:15:10 GMT

I am trying to update our application to 100.5 from 10.2.9. I am trying to authenticate the application and have an application setup for the application in our AGOL Organization with a client id and redirect uri. Am running into issues using OAuthLoginManager when I run oAuthLoginManager.launchOAuthBrowserPage(context); I get the message...

Please copy this code, switch to your application and paste it there. Struggling to find a good example that describes this. Also strange that it opens up Chrome rather than opening within the app as it did with 10.2.9. Any guidance in the right direction greatly appreciated.

private OAuthManagement() {

final int OAUTH_EXPIRATION_NEVER = -1;
oAuthLoginManager = new OAuthLoginManager("https://arcgis.com", "YOUR_CLIENT_ID", "urn:ietf:wg:oauth:2.0:oob", OAUTH_EXPIRATION_NEVER);
}

public void LaunchLogin(Context context) {
oAuthLoginManager.launchOAuthBrowserPage(context);
}

public void handleTokenCredential(Intent intent) {
portal = new Portal("https://www.arcgis.com", true);
ListenableFuture<OAuthTokenCredential> futureToken = oAuthLoginManager.fetchOAuthTokenCredentialAsync(intent);

try {
OAuthTokenCredential oAuthTokenCredential = futureToken.get();
portal.setCredential(oAuthTokenCredential);
portal.loadAsync();
portal.addDoneLoadingListener(new Runnable() {
@Override
public void run() {
if(portal.getLoadStatus() == LoadStatus.LOADED) {
ArcGISRuntimeEnvironment.setLicense(portal.getPortalInfo().getLicenseInfo());
}
}
});

} catch (InterruptedException e) {
e.printStackTrace();
} catch (ExecutionException e) {
e.printStackTrace();
}
}
}

Re: OAuthLoginManager

GuntherHeppner — Sun, 12 Dec 2021 02:49:31 GMT

Hi Aaron,

I suggest you use our DefaultAuthenticationChallengeHandler to implement authentication with the portal.

https://developers.arcgis.com/android/latest/api-reference/reference/com/esri/arcgisruntime/security/DefaultAuthenticationChallengeHandler.html

If you want to authenticate via OAuth you have to implement the following steps:

1. Set the DefaultAuthenticationChallengeHandler on the AuthenticationManager by calling AuthenticationManager.setAuthenticationChallengeHandler(authenticationChallengeHandler).

2. Add an OAuth configuration to the AuthenticationManager with AuthenticationManager.addOAuthConfiguration(OAuthConfiguration)

3. Handle the apps redirect URI with the DefaultOAuthIntentReceiver, which needs to be added to your manifest:

<activity
   android:name="com.esri.arcgisruntime.security.DefaultOAuthIntentReceiver"
   android:launchMode="singleTask"
   android:configChanges="keyboard|keyboardHidden|orientation|screenSize"
   android:label="YourLabel">
   <intent-filter>
     <action android:name="android.intent.action.VIEW"/>
     <category android:name="android.intent.category.DEFAULT"/>
     <category android:name="android.intent.category.BROWSABLE"/>
     <data android:scheme="your-redirect-URI"/>
   </intent-filter>
 </activity>‍‍‍‍‍‍‍‍‍‍‍‍

Note that the DefaultAuthenticationChallengeHandler will always use a device-installed browser window to prompt users for credentials instead of prompting within the application, which is in line with the OAuth security guidelines.

Unfortunately we don't have a sample of this published yet, but we are working on it.

Gunther

Re: OAuthLoginManager

Anonymous User — Tue, 14 May 2019 20:00:31 GMT

Hi Gunther, I am able to follow what you are saying on steps 1 and 2 in

your response. A couple of questions.

1. The code that needs to be added to the AndroidManifest.xml. Wouldn't I

just add in *

Re: OAuthLoginManager

Anonymous User — Tue, 14 May 2019 21:09:29 GMT

Gunther, Tried to respond via email and it look like it cut off what I wrote...below is my reply...

Hi Gunther, I am able to follow what you are saying on steps 1 and 2 in your response. A couple of questions.

1. The code that needs to be added to the AndroidManifest.xml. Wouldn't I just add in <data android:scheme="urn:ietf:wg:oauth:2.0:oob "/>

to an existing activity where I am handling as below or is there some other things going on in ...?

AuthenticationChallengeHandler handler = new DefaultAuthenticationChallengeHandler(this);

AuthenticationManager.setAuthenticationChallengeHandler(handler);

OAuthConfiguration oAC = new OAuthConfiguration(urlLogin, Client_ID, "urn:ietf:wg:oauth:2.0:oob", OAUTH_EXPIRATION_NEVER);

AuthenticationManager.addOAuthConfiguration(oAC);

2. Don't really understand how I am supposed to launch the login page. With OauthLoginManager I use this...

oAuthLoginManager.launchOAuthBrowserPage(getApplicationContext());

How do I launch the login with AuthenticationManager?

3. Will this method produce a credential? I want to avoid the user having to login every time they open up the application. In 10.2.9 we were storing and encrypting AGOL credentials on the device.

Re: OAuthLoginManager

GuntherHeppner — Wed, 15 May 2019 10:51:21 GMT

Hi Aaron,

1. The DefaultOAuthIntentReceiver is an activity provided by the SDK for you. You just need to add it to your manifest so it can handle redirect intents from the browser. You don't need to handle the intents from the browser in your own activity.

2. You don't need to launch the login page by yourself, the SDK will do that for you as soon as you load your Portal instance. As soon as you call portal.loadAsync() you should get prompted for credentials. That means you don't need to set a credential on the Portal instance before you load it.

3. Once the user has provided the correct username and password in the login page, a credential will be set on the Portal instance. The SDK also caches this credential in the AuthenticationManager.CredentialCache. You can persist this cache to json and restore it later on. Encrypting the stored credentials is something you need to take care of, just like in 10.2.9.

https://developers.arcgis.com/android/latest/api-reference/reference/com/esri/arcgisruntime/security/AuthenticationManager.CredentialCache.html

Re: OAuthLoginManager

Anonymous User — Wed, 15 May 2019 18:17:07 GMT

Hi Gunther, All of that makes sense. Have initiated the way you describe and for whatever reason am not seeing a login prompt...

AndroidManifest.xml

Function from OnCreate of Launcher Activity

String urlLogin = getResources().getString(R.string.portal_url);

try {
AuthenticationChallengeHandler handler = new DefaultAuthenticationChallengeHandler(this);
OAuthConfiguration oAC = new OAuthConfiguration(urlLogin, Client_ID2, "urn:ietf:wg:oauth:2.0:oob", OAUTH_EXPIRATION_NEVER);
AuthenticationManager.addOAuthConfiguration(oAC);
AuthenticationManager.setAuthenticationChallengeHandler(handler);

} catch (MalformedURLException e) {
throw new AssertionError(e);
}

// create a portal to ArcGIS Online
Portal portal = new Portal(urlLogin);

portal.addDoneLoadingListener(new Runnable() {
@Override
public void run() {
if (portal.getLoadStatus() == LoadStatus.LOADED) {
// loaded
//String x = portal.getUser().getFullName();
}
}
});

portal.loadAsync();

Re: OAuthLoginManager

Anonymous User — Wed, 15 May 2019 19:31:21 GMT

Gunther, OK my bad on this. Neglected to set loginRequired to "true" on Portal..

Portal portal = new Portal(urlLogin, true);

That code above works to prompt login once that is done.

Re: OAuthLoginManager

Anonymous User — Wed, 15 May 2019 19:43:08 GMT

Gunther, OK am back to the same issue as with the other method. Get this after I login with AGOL credentials. Tried several organizations I have membership to, but got the same results every time.

Re: OAuthLoginManager

GuntherHeppner — Wed, 15 May 2019 19:46:47 GMT

Aaron,

Setting the "loginRequired" flag to true when constructing the Portal is the right way to do it. Otherwise, if your Portal allows anonymous login, it won't prompt upon loading.

Glad you could make it work.

Gunther

Re: OAuthLoginManager

Anonymous User — Wed, 15 May 2019 20:01:43 GMT

Also added in code for onResume when back in the application that portal (which I am making an activity level variable) does not return the credential after username and password have been entered in triggered by portal.loadAsync();

in onResume after return to app

portal.getCredential() returns null.

Re: OAuthLoginManager

XuemingWu — Thu, 16 May 2019 00:41:39 GMT

Aaron,

You should use a custom redirect_uri instead of the known uri "urn:ietf:wg:oauth:2.0:oob" in your Android app. In order to allow the browser to redirect the user back to your app after they authorize your app you need to setup a custom redirect_uri. An example of a custom redirect_uri is "my-arcgis-app://auth". The following changes are needed. Before making these changes, you need to add the custom redirect_uri to your application on ArcGIS Online or your on-premise portal. More info about configuring a redirect URI can be found at this guide doc.

1. Modify the intent-filter in the AndroidManifest.xml:

change

2. Modify the redirectUri parameter passed to the OAuthConfiguration:

change

OAuthConfiguration oAC = new OAuthConfiguration(urlLogin, Client_ID2, "urn:ietf:wg:oauth:2.0:oob", OAUTH_EXPIRATION_NEVER);

OAuthConfiguration oAC = new OAuthConfiguration(urlLogin, Client_ID2, "my-arcgis-app://auth", OAUTH_EXPIRATION_NEVER);

thanks,

Xueming

Re: OAuthLoginManager

Anonymous User — Sun, 12 Dec 2021 02:49:34 GMT

Thanks Xueming! That worked.

A follow up question. So a question after login is successful and back in portal listener...

portal.getCredential() returns a regular Credential

Is there anyway to pull an OAuthTokenCredential from the AuthenticationManager after login?  
Cannot seem to find a good example of this.

The reason we need an OAuthTokenCredential is that in the app we have the ability to download TPK files and in order to download I follow this pattern using the token to do a stock Android download...

String token = mOauthToken.getAccessToken();
requestUrl = portal.getUri() + "/sharing/rest/content/items/" + itemID + "/data?token=" + token;
URL url = new URL(requestUrl);
HttpURLConnection urlConnection = (HttpURLConnection) url.openConnection();

Seems like something like this might work alternatively....but am struggling to figure out how to create an authorizationCode

OAuthTokenCredentialRequest request = new OAuthTokenCredentialRequest(finalURLLogin, null, Client_ID2, "my-arcgis-app://auth", authorizationCode);

Re: OAuthLoginManager

XuemingWu — Thu, 16 May 2019 22:05:15 GMT

Aaron,

You are very welcome.

You don't need to pull the credential from AuthenticationManager. When you access a portal with OAuth, the credential comes back should be an instance of OAuthTokenCredential, meaning you can cast it to an OAuthTokenCredential like the following:

OAuthTokenCredential credential = ((OAuthTokenCredential) portal.getCredential());

As for downloading TPK files from a portal, our SDK provides another option which is a class called ArcGISDownloadRequest. This class extends Android's DownloadManager.Request and works with token-based and OAuth authentication. You can create a Request by calling:

ArcGISDownloadRequest.createInstance(portal.getUri() + "/sharing/rest/content/items/" + itemID + "/data");

As you already use the DefaultAuthenticationChallengeHandler to deal with authentication in your app, it is unnecessary to use OAuthTokenCredentialRequest to obtain credential. Though the DefaultAuthenticationChallengeHandler also calls OAuthTokenCredentialRequest, there are a few more steps to get the authorization code, launch the sign in page in a browser and then obtain the credential. The DefaultAuthenticationChallengeHandler takes case all the details and is the recommended approach for our users.

Cheers,

Xueming

Re: OAuthLoginManager

Anonymous User — Sun, 12 Dec 2021 02:49:37 GMT

Xueming, Thank you for that quick tip. Should have thought about casting the credential. For everyone else's benefit below is a summary of how to get your app authenticated and create a credential for further use in your application.

1. In you application in AGOL add in a new redirect uri as follows...

"my-arcgis-app://auth"

2. In you Android Manifest add in the following...

<activity
    android:name="com.esri.arcgisruntime.security.DefaultOAuthIntentReceiver"
    android:launchMode="singleTask"
    android:configChanges="keyboard|keyboardHidden|orientation|screenSize"
    android:label="YourLabel">
    <intent-filter>
        <action android:name="android.intent.action.VIEW"/>
        <category android:name="android.intent.category.DEFAULT"/>
        <category android:name="android.intent.category.BROWSABLE"/>
        <data android:scheme="my-arcgis-app"/>
    </intent-filter>
</activity>

3.  In onCreate of your Activity...Note that client id also is known from you application in AGOL

String urlLogin = "https://www.arcgis.com";
try {
   int OAUTH_EXPIRATION_NEVER = -1;
final AuthenticationChallengeHandler handler = new DefaultAuthenticationChallengeHandler(this);
 final OAuthConfiguration oAC = new OAuthConfiguration(urlLogin, Client_ID, "my-arcgis-app://auth", OAUTH_EXPIRATION_NEVER);
 AuthenticationManager.addOAuthConfiguration(oAC);
 AuthenticationManager.setAuthenticationChallengeHandler(handler);
} catch (MalformedURLException e) {
 //String x = e.getMessage();
 throw new AssertionError(e);
}

// create a portal to ArcGIS Online
portal = new Portal(urlLogin, true);

portal.addDoneLoadingListener(new Runnable() {
 @Override
 public void run() {
 try {
 if (portal.getLoadStatus() == LoadStatus.LOADED) {
 // loaded
 // get the authorization code by sending user to the authorization screen
 OAuthTokenCredential mValidLoginCredentials = (OAuthTokenCredential) portal.getCredential();
         }
 } catch (Exception e) {
 e.printStackTrace();
 }
 }
});

Re: OAuthLoginManager

Anonymous User — Sun, 12 Dec 2021 02:49:39 GMT

Argh forgot an important detail...portal.loadAsync(); is what initiates portal and request for creds...

// create a portal to ArcGIS Online
portal = new Portal(urlLogin, true);

portal.addDoneLoadingListener(new Runnable() {
 @Override
 public void run() {
 try {
 if (portal.getLoadStatus() == LoadStatus.LOADED) {
 // loaded
 // get the authorization code by sending user to the authorization screen
 OAuthTokenCredential mValidLoginCredentials = (OAuthTokenCredential) portal.getCredential();
         }
 } catch (Exception e) {
 e.printStackTrace();
 }
 }
});

portal.loadAsync();

Re: OAuthLoginManager

Anonymous User — Fri, 17 May 2019 15:49:40 GMT

OK one other comment on this method for login. When using this method the default browser is used for login. The unfortunate consequence is that each time you login a new tab is opened in your internet browser on your device (in my case Chrome). When I later access Chrome Browser I see a tab for each time I logged in with credentials still in there. Is there a built in way to close the browser tab after done? I can see this being a problem in the production environment.

Re: OAuthLoginManager

GuntherHeppner — Fri, 17 May 2019 15:55:33 GMT

Hi Aaron,

This is a bug we are aware of and currently trying to fix. We are not aware of any workaround.

Gunther