AppAuth iOS. How to save the token info after user registers an account in my own OAuth2 server

Question

I have an iOS app and a backend written in Spring with OAuth2 mechanizm implemented.

I have a signup endpoint in my backend, which accepts some user data and returns an OAuth2 response, e.g.

{
    "access_token":"9154140d-b621-4391-9fdd-fbba9e5e4188",
    "token_type":"bearer",
    "refresh_token":"dd612036-7cc6-4858-a30f-c548fc2a823c",
    "expires_in":89,
    "scope":"write"
}

After that I want to save OIDAuthState in my keychain, so I do the following:

func saveTokenResponse(responseDict: [String: NSCopying & NSObjectProtocol]) {
        let redirectURI = URL(string: kRedirectURI)
        let configuration = OIDServiceConfiguration(authorizationEndpoint: URL(string: kAuthorizationEndpoint)!, tokenEndpoint: URL(string: kTokenEndpoint)!)
        let request = OIDAuthorizationRequest(configuration: configuration, clientId: self.kClientID, scopes: ["write"], redirectURL: redirectURI!, responseType: OIDResponseTypeCode, additionalParameters: nil)

        let accessToken = responseDict["access_token"] ?? nil
        let tokenType = responseDict["token_type"] ?? nil
        let refreshToken = responseDict["refresh_token"] ?? nil
        let expiresIn = responseDict["expires_in"] ?? nil
        let scope = responseDict["scope"] ?? nil

        let response = OIDAuthorizationResponse(request: request, parameters: [
            "access_token": accessToken!,
            "token_type": tokenType!,
            "refresh_token": refreshToken!,
            "expires_in": expiresIn!,
            "scope": scope!
            ]
        )
        let authState = OIDAuthState(authorizationResponse: response) //here authState.refreshToken is nil, so it won't be serialized.

        updateAuthState(authState: authState) // it just saves it in keychain
    }

Everything works well, but I have an issue when the token expires. The app makes a call to the backend and AppAuth is not able to refresh the token:

I can see, that the refresh token is not present in the OIDAuthState object. I have checked the initialization of the OIDAuthState from OIDAuthorizationResponse and found out that token is not assigned in that case.

Can anybody help how I can save OIDAuthState from the OAuth response I receive from my backend? Or am I doing something in a wrong way?

Thanks,

Osman

Answer 1

I ran into this same issue using AppAuth for iOS (refreshToken was null). I was able to get it working by adding adding "offline_access" to my scopes.

let request = OIDAuthorizationRequest(configuration: configuration!, clientId: self.kClientID, scopes: [OIDScopeOpenID, OIDScopeProfile, "api", "offline_access"], redirectURL: redirectURI! as URL, responseType: OIDResponseTypeCode, additionalParameters: nil)