Downloaded 28 times
![AKAccount Base
@interface AKAccount ()
@property(nonatomic, copy, readwrite) NSString *identifier;
@end
@implementation AKAccount
+ (instancetype)accountWithIdentifier:(NSString *)identifier {
return [[self alloc] initWithIdentifier:identifier];
}
- (id)initWithIdentifier:(NSString *)identifier {
self = [super init];
if (self) {
_identifier = identifier;
}
return self;
}
- (void)clearCredential {
// Abstract method.
}
@end
79](https://image.slidesharecdn.com/iosautharchforall-130406084817-phpapp02/85/An-iOS-Authentication-Architecture-for-All-79-320.jpg)
![GTMOAuth 2
- (AKOAuth2AccountCredential *)OAuth2Credential {
AKGTMOAuth2AuthController *authController =
[AKGTMOAuth2AuthController sharedController];
GTMOAuth2Authentication *auth = [authController
newGTMOAuth2Authentication];
if (!auth) {
return nil;
}
BOOL isAuthenticated =
[GTMOAuth2ViewControllerTouch
authorizeFromKeychainForName:authController.keychainItemName
authentication:auth];
if (!isAuthenticated) {
return nil;
}
AKOAuth2AccountCredential *credential =
[[AKOAuth2AccountCredential alloc] init];
credential.accessToken = auth.accessToken;
return credential;
}
91](https://image.slidesharecdn.com/iosautharchforall-130406084817-phpapp02/85/An-iOS-Authentication-Architecture-for-All-91-320.jpg)
Uploaded byRené Cacheaux
An iOS Authentication Architecture for All
This document outlines an iOS authentication architecture pattern called CocoaAuth that is designed to simplify authentication workflows. It discusses three main patterns: 1) Accounts, which defines the model layer for credentials and account management, 2) Auth Controllers, which control authentication flows, and 3) Auth UI, which handles the user interface for authentication. The goal of this pattern is to save developers time by avoiding having to reinvent authentication wheels and providing a consistent user experience.
An iOS Authentication Architecture for All
- 1.
- 2. An iOS Authentication Architecture for All How to stop reinventing the auth wheel 2
- 3. René Cacheaux Senior iOSEngineer rene.cacheaux@mutualmobile.com 3
- 4. There’s a Pattern for That 4
- 5. WHAT’S THE BIGDEAL? 5
- 6. Spend Time Building Features that ROCK 6
- 7.
- 8. Build Reliable and Secure Apps 8
- 9.
- 10.
- 11.
- 12.
- 13.
- 14.
- 15.
- 16.
- 17.
- 18.
- 19.
- 20. but then... 20
- 21.
- 22. O...AUTH 22
- 23. Really!? 23
- 24. What exactly is OAuth? 24
- 25. WAIT! I have touse a UIWebView?! 25
- 26. Is there alibrary for this?? 26
- 27.
- 28. Just Download It! 28
- 29. But then... 29
- 30. Things start going wrong... 30
- 31. GTMOAuth 1or 2? 31
- 32. Is Linked inOAuth 1 or 2? 32
- 33. BOTH? 33
- 34.
- 35.
- 36. Jen! 36
- 37.
- 38. Jen went to CocoaConfand... 38
- 39.
- 40. CocoaAuth 40
- 41. AND there’s areference implementation 41
- 42. Auth Kit 42
- 43. Three Patterns ThreeSteps 43
- 44. Three Patters Three Steps 1 2 3 Accounts Auth Auth UI Controllers 44
- 45. But first... 45
- 46. John chose OAuth2 for Linked in 46
- 47. Why? 47
- 48. John chose Google’s GTMOAuth 48
- 49. Why? 49
- 50. Back to: Three patterns Three steps 50
- 51. Three Patters Three Steps 1 2 3 Accounts Auth Auth UI Controllers 51
- 52. So we wantto implement Accounts... 52
- 53.
- 54. Meet OAuth 2.0 OAuth 2 54
- 55. 1st thing... 55
- 56. image by tv The Access Token 56
- 57. It’s... 57
- 58. Opaque 58
- 59. It has... 59
- 60. Scopes 60
- 61. and it... 61
- 62. Expires 62
- 63. That’s OAuth 2 Access Token On to Step 1, Accounts 63
- 64. 1 Accounts 64
- 65. If you needAuth you have user’s... 65
- 66. And if youhave users, you need account management 66
- 67. Accounts makes up the model layer 67
- 68. 3 Entities in Accounts 68
- 69. 1 Credentials 2 Accounts 3 Store 69
- 70. 1 Credentials 2 Accounts 3 Store 70
- 71. AKOAuth2AccountCredential : NSObject @property(nonatomic,copy) NSString *accessToken; @property(nonatomic, strong) NSDate *expirationDate; 71
- 72. That’s all for credentials, super easy. Accounts is next. 72
- 73. 1 Credentials 2 Accounts 3 Store 73
- 74. AKAccount : NSObject @property(nonatomic,copy, readonly) NSString *identifier; @property(nonatomic, copy, readonly) NSString *username; @property(nonatomic, copy, readonly) NSString *accountType; - (void)clearCredential; 74
- 75. 1 Account Type 2 Subclassing 75
- 76.
- 77.
- 78. Class Structure Base Auth Protocol Library 78
- 79. AKAccount Base @interface AKAccount() @property(nonatomic, copy, readwrite) NSString *identifier; @end @implementation AKAccount + (instancetype)accountWithIdentifier:(NSString *)identifier { return [[self alloc] initWithIdentifier:identifier]; } - (id)initWithIdentifier:(NSString *)identifier { self = [super init]; if (self) { _identifier = identifier; } return self; } - (void)clearCredential { // Abstract method. } @end 79
- 80. AKOAuth2Account @class AKOAuth2AccountCredential; @interface AKOAuth2Account: AKAccount @property(nonatomic, strong, readonly) AKOAuth2AccountCredential *OAuth2Credential; @end @implementation AKOAuth2Account - (AKOAuth2AccountCredential *)OAuth2Credential { // Subclasses should implement this. They should always access // credentials from a secure store. return nil; } @end 80
- 81. AKGTMOAuth2Account @implementation AKGTMOAuth2Account - (AKOAuth2AccountCredential*)OAuth2Credential { // Get credential from Google's GTMOAuth2 library. } - (void)clearCredential { // Remove credential from storage. } @end 81
- 82. AKAccount : NSObject @property(nonatomic,copy, readonly) NSString *identifier; @property(nonatomic, copy, readonly) NSString *username; @property(nonatomic, copy, readonly) NSString *accountType; - (void)clearCredential; 82
- 83. 1 Credentials 2 Accounts 3 Store 83
- 84. AKAccountStore : NSObject +(void)registerAccountTypeClass:(Class)accountTypeClass; + (instancetype)sharedStore; - (AKAccount *)newAccount; - (void)saveAccount:(AKAccount *)account; - (AKAccount *)authenticatedAccount; 84
- 85. Implementing 1 Account Ref Store 2 Credential Store 85
- 86. Implementing 1 Account Ref Store 2 Credential Store 86
- 87. Implementing 1 Account Ref Store 2 Credential Store 87
- 88. Credential Store 1 Keychain 2 Library Provided 88
- 89. 1 Keychain 89
- 90. 2 Library Provided Store 90
- 91. GTMOAuth 2 - (AKOAuth2AccountCredential*)OAuth2Credential { AKGTMOAuth2AuthController *authController = [AKGTMOAuth2AuthController sharedController]; GTMOAuth2Authentication *auth = [authController newGTMOAuth2Authentication]; if (!auth) { return nil; } BOOL isAuthenticated = [GTMOAuth2ViewControllerTouch authorizeFromKeychainForName:authController.keychainItemName authentication:auth]; if (!isAuthenticated) { return nil; } AKOAuth2AccountCredential *credential = [[AKOAuth2AccountCredential alloc] init]; credential.accessToken = auth.accessToken; return credential; } 91
- 92. AKAccountStore : NSObject +(void)registerAccountTypeClass:(Class)accountTypeClass; + (instancetype)sharedStore; - (AKAccount *)newAccount; - (void)saveAccount:(AKAccount *)account; - (AKAccount *)authenticatedAccount; 92
- 93.
- 94.
- 95. Before looking at AuthController... 95
- 96.
- 97. The Actors Client Authorization Server Resource Server 97
- 98. The Client APP 98
- 99.
- 100. Resource Server 100
- 101. Before you can authenticateagainst an API’s OAuth you have to ... 101
- 102.
- 103. Linked in 103
- 104. And that givesyou: 104
- 105. Client ID 105
- 106. Client Secret 106
- 107. That’s it. TheBasics. 107
- 108. 2 Auth Controller image by Damien Erambert 108
- 109. If you haveauth... 109
- 110. You have alogin... 110
- 111. If you havelogin, UIKit has to launch a login flow. 111
- 112. Something has to bein control, no? 112
- 113. 2 Protocols 113
- 114. <AKAuthControl> - (void)beginAuthenticationAttempt; - (void)unauthenticateAccount:(AKAccount*)account; <AKAuthHandler> - (void)presentAKLoginViewController:(UIViewController *)viewController; - (void)authControllerAccount:(AKAccount *)account didAuthenticate:(id<AKAuthControl>)authController; - (void)authControllerAccount:(AKAccount *)account didUnauthenticate:(id<AKAuthControl>)authController; 114
- 115. Now the starof the show, AKAuthController 115
- 116. AKAuthController : NSObject<AKAuthControl> @property(nonatomic,weak) id<AKAuthHandler> authHandler; + (instancetype)sharedController; it’s abstract 116
- 117. Simple 117
- 118. How does itwork? 118
- 119. 1 The Flows 2 Linkedin Auth Controller 3 Calling Linkedin API 119
- 120. The Flows 120
- 121. Login View Flow id<AKAuthHandler> AKAuthController Login UIViewController beginAuthenticationAttempt initialize presentAKLoginViewController: user authenticated authControllerAccount:didAuthenticate: 121
- 122. Authenticated Flow id <AKAuthHandler> AKAuthController beginAuthenticationAttempt authControllerAccount:didAuthenticate: 122
- 123. Bounce Back Flow id<AKAuthHandler> AKAuthController Safari App Delegate beginAuthenticationAttempt open URL open URL user authenticated authControllerAccount:didAuthenticate: 123
- 124. So, the Linkedin Auth Controller 124
- 125. But first... 125
- 126. Last OAuth 2Lesson 126
- 127. Two Steps 1 The Grant 2 The Access Token (Part 2) 127
- 128. The Grant 128
- 129. Yes, there IS anothertoken. 129
- 130. Auth Code Browser The Request The Redirect 130
- 131. Browser 131
- 132. The Request 132
- 133. Client Browser Auth Server Auth Code Request URL Auth Code GET Request HTML Flow Redirect URL with Auth Code Redirect URL with Auth Code 133
- 134. Query String Params https://www.linkedin.com/uas/oauth2/authorization ?response_type=code &client_id=YOUR_API_KEY &scope=SCOPE &state=STATE &redirect_uri=YOUR_REDIRECT_URI 134
- 135. The Redirect 135
- 136. Client Browser Auth Server Auth Code Request URL Auth Code GET Request HTML Flow Redirect URL with Auth Code Redirect URL with Auth Code 136
- 137. And now, getthe Auth Code... 137
- 138. It’s in theredirect URL query string. YOUR_REDIRECT_URI/?code=AUTHORIZATION_CODE 138
- 139. So that’s theAuth Code Grant 139
- 140. Now, it’s timefor some more Access Token fun. 140
- 141. The Access Token 141
- 142. Now that Ihave an Auth Code... 142
- 143. How do Iget an Access Token? 143
- 144. Request Response 144
- 145. Request 145
- 146. Client Auth Server Access Token POST Request with Auth Code JSON with Access Token 146
- 147. Query String Params https://www.linkedin.com/uas/oauth2/accessToken ?grant_type=authorization_code &code=AUTHORIZATION_CODE &redirect_uri=YOUR_REDIRECT_URI &client_id=YOUR_API_KEY &client_secret=YOUR_SECRET_KEY 147
- 148. Response 148
- 149. Client Auth Server Access Token POST Request with Auth Code JSON with Access Token 149
- 150. Payload { "expires_in":5184000, "access_token":"AQXdSP_W41_UPs5ioT_t8HESyODB4FqbkJ8LrV_5mf f4gPODzOYR" } 150
- 151. So that’s howyou get an Access Token 151
- 152. Back to... Linkedin Auth Controller 152
- 153. Subclass Structure AKAuthController Base AKGTMOAuth2AuthController Auth Protocol MALinkedInAuthController Library 153
- 154. Using GTMOAuth2 154
- 155. Code Demo 155
- 156. We now havean Access token in the Keychain 156
- 157. Time to makesome API Calls 157
- 158. Calling the Linked inAPI 158
- 159. 1 Getting Access Token from Account Store 2 Using the Access Token 3 Handling Bad Token Responses 159
- 160. 1 Getting Access Token 160
- 161.
- 162. Client Resource Server API Request with Access Token Protected Resource 162
- 163. Code Demo 163
- 164.
- 165. 3 Bad Token 165
- 166.
- 167. AKAuthController Client Resource Server API Request with Access Token Bad Token Unauthenticate Account 167
- 168. Log Out Account 168
- 169. And... Wait How willthe app react? 169
- 170. That’s where Auth UI comes in. 170
- 171. 3 Auth UI 171
- 172. Container View Controller 172
- 173. Application Container ViewController Unauthenticated View Authenticated View Controller Controller 173
- 174. 1 Children View Controllers 2 Installation 3 Flows 174
- 175. Children 175
- 176. Installation 176
- 177. Code Demo 177
- 178. Flows 178
- 179. Log In 179
- 180. Child Controller Container Auth Controller beginAuthenticationAttempt beginAuthenticationAttempt authControllerAccount:didAuthenticate: transition into authenticated view controller 180
- 181. Log Out 181
- 182. Child Controller Container Auth Controller authControllerAccount:didUnauthenticate: transition into unauthenticated view controller 182
- 183. That’s AuthUI 183
- 184. Whew! Those are the Patterns 184
- 185. Back in SFO... 185
- 186.
- 187.
- 188. And the winneris... 188
- 189.
- 190.
- 191.
- 192.
- 193. John opens a hookahbar... 193
- 194.
- 195. and 195
- 196. JUST MARRIED! 196
- 197. The End 197
- 198. So what’s thepoint? 198
- 199. Auth Sucks 199
- 200. Auth Takes Time 200
- 201. It gets inthe way 201
- 202. Don’t spend TIME onauth 202
- 203.
- 204. Benefits 204
- 205. Save Time and Effort 205
- 206.
- 207. It’s simple 207
- 208. Future 208
- 209. Future of iOS 209
- 210. Future of CocoaAuth & Auth Kit 210
- 211. Resources 211
- 212.
- 213. René Cacheaux Senior iOSEngineer rene.cacheaux@mutualmobile.com @RCachATX rene.cacheaux@gmail.com 213
- 214.