Subject: [OAUTH-WG] Authorization handover from mobile app to website

From: "SOMMER, DOMINIK" <[email-masked]>
Date: Fri, 12 Mar 2021 18:18:43 +0000

Hi all,

we have recently launched a mobile app that uses our website’s login and authorization code flow to authenticate and authorize user access (following RFC8252).

However, not all of our website features are natively ported to the app itself. Some are only available on the website in logged-in state. That’s why we implemented an authorization handover mechanism based on one-time login codes: This allows the app (in logged-in state) to open a web view and hand over authentication & authorization, effectively logging the user in on the website. This achieves a seamless experience for the user without compromising on security.

We came up with this mechanism after researching for prior practice, but we couldn’t find anything applicable for this scenario.

Hence, three questions to the list:
1. Did we miss anything in our research? Is there a common best practice available?
2. If the answer to 1. is “No”, would the working group appreciate an RFC draft describing the solution we came up with? (We’d be eager for comments to make it even more secure ☺ )
3. If the answer to 2. is “Yes”, can someone point me to documentation on the procedure, if such exist?

Thanks for your support and
best regards,
Dominik

Sitz der Gesellschaft / Corporate Headquarters: Miles & More GmbH, Frankfurt am Main, Registereintragung / Registration: Amtsgericht Frankfurt am Main HRB 116409
Geschaeftsfuehrung / Management Board: Sebastian Riedle, Dr. Oliver Schmitt

---

From: George Fletcher <[email-masked]>
Date: Fri, 12 Mar 2021 15:37:41 -0500

I can't find a record of sending this to the list, but I wrote this ID 
back in 2013 and we've implemented it. At the time I did vet it with a 
few people. Hopefully it might be helpful :)

Thanks,
George

On 3/12/21 1:18 PM, SOMMER, DOMINIK wrote:
>
> Hi all,
>
> we have recently launched a mobile app that uses our website’s login 
> and authorization code flow to authenticate and authorize user access 
> (following RFC8252).
>
> However, not all of our website features are natively ported to the 
> app itself. Some are only available on the website in logged-in state. 
> That’s why we implemented an authorization handover mechanism based on 
> one-time login codes: This allows the app (in logged-in state) to open 
> a web view and hand over authentication & authorization, effectively 
> logging the user in on the website. This achieves a seamless 
> experience for the user without compromising on security.
>
> We came up with this mechanism after researching for prior practice, 
> but we couldn’t find anything applicable for this scenario.
>
> 2. If the answer to 1. is “No”, would the working group appreciate an 
> RFC draft describing the solution we came up with? (We’d be eager for 
> comments to make it even more secure J)
>
> Sitz der Gesellschaft / Corporate Headquarters: Miles & More GmbH, 
> Frankfurt am Main, Registereintragung / Registration: Amtsgericht 
> Frankfurt am Main HRB 116409
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

-- 
Identity Standards Architect
Verizon Media                     Work: [email-masked]
Mobile: +1-703-462-3494           Twitter: http://twitter.com/gffletch
Office: +1-703-265-2544           Photos: http://georgefletcher.photography

---

From: Nov Matake <[email-masked]>
Date: Sat, 13 Mar 2021 12:59:57 +0900

You can make your app an OIDC self-issued IdP for your website.

One of my clients are using the mechanism for Native App SSO, where an OIDC self-issued IdP embedded in the Native App is acting as IdP for the backend IdP server.

Unfortunately I have no english document now, but this slide describes the mechanism.
https://speakerdeck.com/rtechkouhou/openid-connect-self-issued-idpwoying-yong-sitasingle-sign-onfalseshi-zhuang

iPadから送信

> 2021/03/13 3:24、SOMMER, DOMINIK <[email-masked]>のメール:
> 
> 
> Hi all,
>  
> 2. If the answer to 1. is “No”, would the working group appreciate an RFC draft describing the solution we came up with? (We’d be eager for comments to make it even more secure J )

---

From: "SOMMER, DOMINIK" <[email-masked]>
Date: Thu, 18 Mar 2021 16:24:43 +0000

I have to admit I can’t read the slides, and the flows aren’t quite self-explanatory. However, just based on the headline I can’t quite figure out how to make a client “in the wild” (= the mobile app) a trusted IdP for a backend. This would basically allow anyone reverse-engineering the app (and it’s keypair) to generate arbitrary ID tokens.

However, I probably get something wrong ☺

- Dominik

Von: Nov Matake <[email-masked]>
Gesendet: Samstag, 13. März 2021 05:00
An: SOMMER, DOMINIK <[email-masked]>
Cc: [email-masked]
Betreff: Re: [OAUTH-WG] Authorization handover from mobile app to website

2021/03/13 3:24、SOMMER, DOMINIK <[email-masked]<mailto:[email-masked]>>のメール:

Hi all,

_______________________________________________
OAuth mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/oauth