Forcing the user to enter their username and password again

[mattio]

Is your feature request related to a problem? Please describe.
Our app has an activity timeout. After you successfully login with your username and password and begin using the app, if you're inactive for 2 minutes, we display a "lock" screen prompting the user to login again. If you minimize the app and then open it again later, we also display that screen if it's been longer than 15 seconds.

Logging in works fine. API access with the tokens works fine. Re-displaying the lock screen works fine. My problem, I believe, is session cookies -- more precisely my inability to clear them. When the user taps the login button again, the SFSafariViewController or SFAuthenticationSession UI appears, and the provider endpoint starts to load. It sees the cookies and automatically redirects the user back into the app, giving the user access.

For this scenario, we don't want that automatic login and redirect. What I'm being asked to do is to force the user to enter their username and password again.

Describe the solution you'd like
What I'd like I know I can't have. ;-) I'd like for SFSafariViewController and SFAuthenticationSession to allow me to clear cookies for my app.

Describe alternatives you've considered
I've tried calling the token revocation endpoint but that doesn't seem to impact the session cookies.

The only other alternative I've come up with is using the end session endpoint. I haven't been able to get it fully working yet, but I was thinking I might be able to call the end session endpoint immediately before sending the user to the login screen. Unfortunately the user experience for that seems like it's going to be terrible. If my understanding is correct, I'd have to call to end session properly so there is no confirmation prompt on the logout screen, redirect back into the app, close that SFSafariViewController or SFAuthenticationSession screen, then open another with the login endpoint. Yikes.

Is there some other way to get this scenario to work?

Additional context
We use IdentityServer.

The remember me checkbox feature is not being used for this scenario.

I do see the work going on in #259, too. Looking forward to that feature as well!

[jogu]

Have you considered passing prompt=login to the authorisation endpoint? (ie. in the additionalParameters parameter when creating OIDAuthorizationRequest..

[mattio]

I've been trying that (saw the option after I submitted this issue), but I think I'm running into odd iOS version issues.

On iOS 9 and 10, when I open the SSO login screen the second time, I'll see the username. If I tap Cancel on the form, I'm redirected into the app with valid tokens as if I had successfully logged in.

On iOS 11, there is no username and if I tap Cancel on the form it correctly dismisses the SFAuthenticationSession and sends me back into the app without updated tokens. So that version works correctly at least.

[alvincrisuy]

I have the same issue. It redirects back to the app without calling the callback in the given example on this repo.

[the-scott-davis]

I am having this problem as well, and the suggestion from @jogu above (passing prompt=login) in the additional parameters value, doesn't seem to work either.

[jogu]

I am having this problem as well, and the suggestion from @jogu above (passing prompt=login) in the additional parameters value, doesn't seem to work either.

There seem to be multiple different issues mentioned above, but if you are correctly passing prompt=login to the authorisation server and it's returning tokens without the user logging in, then your problem is in the authorisation server and you're best off asking the vendor for help.

For what it's worth, I've been using it with PingFederate and it works well. I've not tried with any other vendors.

[mattio]

For anyone else interested, here's what we're currently planning to do for this scenario:

1. The activity timer fires and our app login screen appears.
2. We're tracking some state in the app and, if the user has logged in previously, when they tap login we send them to the end session endpoint first to make sure the cookie is cleared. The user gets redirected back into the app, then we immediately start a new flow to log them back in.
3. Our scenario is also similar to Support sign on without SSO (no SFAuthenticationSession) #209 in that we have our own IdP and we want the user to move seamlessly between the app and our website. Because the iOS SFAuthenticationSession and ASWebAuthenticationSession have the new system prompt, we're forcing the use of SFSafariViewController.

It is certainly not ideal, but since we encourage Touch ID / Face ID usage we're willing to make the compromise.

We're also still trying to figure out why prompt=login followed by the user tapping Cancel on the IdP login form gives us fresh tokens. If we resolve that, then all this other nonsense goes away!

[balkarov]

Hello. I have the same problem.
After logout in app I want to clear all cookies and cache for login again later.
I try use this code:

HTTPCookieStorage.shared.cookies?.forEach(HTTPCookieStorage.shared.deleteCookie)
        URLCache.shared.removeAllCachedResponses()

WKWebsiteDataStore.default().fetchDataRecords(ofTypes: WKWebsiteDataStore.allWebsiteDataTypes()) { records in
            records.forEach { record in
WKWebsiteDataStore.default().removeData(ofTypes: record.dataTypes, for: [record], completionHandler: { })
            }
        }

But it does not help me. Because I after open AuthController user automatically redirects to success.

UPDATE:
I think I need send logout in identityServer, but for me better have in discoverConfiguration end_session_endpoint for sending post logout request.

[WilliamDenniss]

Glad you solved it @mattio. For reference here is the gist I published for using SFSafariViewController with AppAuth in non-SSO mode: #209 (comment)