SalesforceSDK/com.salesforce.androidsdk.auth/OAuth2

OAuth2

open class OAuth2

Helper methods for common OAuth2 requests.

The typical OAuth2 flow is:

The authorization flow is started by presenting the web-based authorization screen to the user. This will prompt him/her to login and to authorize our application. The result will be a callback with an authorization code, or an error.
Use the authorization code from (a) with the token end point, to get access and refresh tokens, as well as other metadata.
Use the access token from (b) to call the identity service, which will let us find out the user's username.
Store the username, and refresh and access tokens somewhere safe (like the AccountManager).
If the access token becomes invalid, use the refresh token to get another access token.
If the refresh token becomes invalid, go back to the beginning.

Constructors

OAuth2

constructor()

Types

IdServiceResponse

open class IdServiceResponse

Helper class to parse an identity service response.

LogoutReason

enum LogoutReason

OAuthFailedException

open class OAuthFailedException : Exception

Exception thrown when the refresh flow fails.

TokenEndpointResponse

open class TokenEndpointResponse

Helper class to parse a token refresh response.

TokenErrorResponse

open class TokenErrorResponse

Helper class to parse a token refresh error response.

Properties

ATTESTATION

val ATTESTATION: String = "attestation"

OAuth 2.

FRONTDOOR_URL_KEY

val FRONTDOOR_URL_KEY: String = "frontdoor_uri"

LOGIN_HINT

val LOGIN_HINT: String = "login_hint"

TIMESTAMP_FORMAT

val TIMESTAMP_FORMAT: DateFormat

Functions

addAuthorizationHeader

open fun addAuthorizationHeader(builder: Request.Builder, authToken: String): Request.Builder

Adds the authorization header to request builder.

open fun addAuthorizationHeader(builder: Request.Builder, authToken: String, @Nullable tokenType: String): Request.Builder

Adds the authorization header to the request builder, choosing the scheme based on the token type.

callIdentityService

open fun callIdentityService(httpAccessor: HttpAccess, identityServiceIdUrl: String, authToken: String): OAuth2.IdServiceResponse

open fun callIdentityService(httpAccessor: HttpAccess, identityServiceIdUrl: String, authToken: String, @Nullable tokenType: String, @Nullable credentialsIdentifier: String): OAuth2.IdServiceResponse

Calls the identity service to determine the username of the user and the mobile policy, given their identity service ID and an access token.

computeScopeParameter

open fun computeScopeParameter(scopes: Array<String>): String

Computes the scope parameter from an array of scopes.

exchangeCode

open fun exchangeCode(httpAccessor: HttpAccess, loginServer: URI, clientId: String, code: String, codeVerifier: String, callbackUrl: String): OAuth2.TokenEndpointResponse

Exchange code for credentials.

open fun exchangeCode(httpAccessor: HttpAccess, loginServer: URI, clientId: String, code: String, codeVerifier: String, callbackUrl: String, salesforceSdkManager: SalesforceSDKManager): OAuth2.TokenEndpointResponse

An internal, testable Salesforce Mobile SDK overload of exchangeCode.

An internal, testable Salesforce Mobile SDK overload of exchangeCode that accepts a credentials identifier so DPoP proof can be attached when enabled.

getAuthorizationUrl

open fun getAuthorizationUrl(useWebServerAuthentication: Boolean, useHybridAuthentication: Boolean, loginServer: URI, clientId: String, callbackUrl: String, scopes: Array<String>, displayType: String, codeChallenge: String, addlParams: Map<String, String>): URI

open fun getAuthorizationUrl(useWebServerAuthentication: Boolean, useHybridAuthentication: Boolean, loginServer: URI, clientId: String, callbackUrl: String, scopes: Array<String>, loginHint: String, displayType: String, codeChallenge: String, addlParams: Map<String, String>): URI

Builds the URL to the authorization web page for this login server.

getFrontdoorUrl

open fun ~~getFrontdoorUrl~~(url: URI, accessToken: String, instanceURL: String, addlParams: Map<String, String>): URI

Returns a 'frontdoor'ed URL Front door will authenticate client navigating to that URL using given access token

getOpenIDToken

open fun getOpenIDToken(loginServer: String, @Nullable instanceServer: String, clientId: String, @Nullable communityId: String, @Nullable communityUrl: String, refreshToken: String): String

Fetches an OpenID token from the Salesforce backend.

makeTokenEndpointRequest

@VisibleForTesting

@WorkerThread

open fun makeTokenEndpointRequest(httpAccessor: HttpAccess, loginServer: URI, formBodyBuilder: FormBody.Builder, salesforceSdkManager: SalesforceSDKManager): OAuth2.TokenEndpointResponse

@VisibleForTesting

@WorkerThread

open fun makeTokenEndpointRequest(httpAccessor: HttpAccess, loginServer: URI, formBodyBuilder: FormBody.Builder, salesforceSdkManager: SalesforceSDKManager, @Nullable credentialsIdentifier: String): OAuth2.TokenEndpointResponse

@WorkerThread

Canonical implementation of the token-endpoint request.

overrideLoginServerIfNeeded

open fun overrideLoginServerIfNeeded(@NonNull userAccount: UserAccount): URI

Selects the server URI to target for token endpoint requests for the given user account.

open fun overrideLoginServerIfNeeded(loginServer: String, @Nullable instanceServer: String, @Nullable communityId: String, @Nullable communityUrl: String): URI

Selects the server URI to target for token endpoint requests.

refreshAuthToken

open fun refreshAuthToken(httpAccessor: HttpAccess, loginServer: URI, clientId: String, refreshToken: String, addlParams: Map<String, String>): OAuth2.TokenEndpointResponse

open fun refreshAuthToken(httpAccessor: HttpAccess, loginServer: URI, clientId: String, refreshToken: String, addlParams: Map<String, String>, @Nullable credentialsIdentifier: String): OAuth2.TokenEndpointResponse

Gets a new auth token using the refresh token.

revokeRefreshToken

open fun revokeRefreshToken(httpAccessor: HttpAccess, loginServer: URI, refreshToken: String, reason: OAuth2.LogoutReason)

Revokes the existing refresh token.

swapJWTForTokens

open fun swapJWTForTokens(httpAccessor: HttpAccess, loginServerUrl: URI, jwt: String): OAuth2.TokenEndpointResponse

Swaps a JWT for regular OAuth tokens.