What would be a good call to implement OAuth 2.0 i...

# compose-ios

[Alex Acosta]

What would be a good call to implement OAuth 2.0 in a KMP project along with compose for iOS and Android?

[Colton Idle]

call?

[Stefan Oltmann]

On client side Ktor.
On server side Keycloak.

[Arjan van Wieringen]

Server side we have good experience with FusionAuth

[Alex Acosta]

client side

[Alex Acosta]

I don't see any github repo already that can be used with openid

[Stefan Oltmann]

You can do OAuth using Ktor. Google for bearer authentication.

[Alex Acosta]

And it will prompt browser for user authentication?

[Stefan Oltmann]

No, you generate the URL yourself and open that via intent in the system browser. As soon as you get your access tokens back it can handle all the rest.

[Stefan Oltmann]

Are you familiar with how OAuth2 and OpenID works?

[Stefan Oltmann]

It’s really not that complicated. You don’t need an extra lib for that. What’s build into Ktor is suitable. At least for the needs of Ashampoo Photos for authenticate with Microsoft (for OneDrive) and Dropbox.

[Stefan Oltmann]

Of course one could build a lib that uses Ktor and contains all the different endpoints for commons providers and the logic for handling the communication. It’s really not that much. Right now I wonder if I should open source that part of Ashampoo Photos 🤔

[Alex Acosta]

I understand how it works, even up to the authorize request and token request. Just wondering if there was a pre-exiting lib that can support multiplatform, even desktop browser.

[Stefan Oltmann]

Ktor is multiplatform.

[Stefan Oltmann]

For the browser part it’s in Ashampoo Photos a small openInBrowser() function using expect/actual to call the system browser. What else do you expect?

[Alex Acosta]

fetching server information from a /.well-known/openid-configuration for example, easy scope management (offline_access)

[Alex Acosta]

handle redirection with custom scheme and fetch the proper query params...

[Alex Acosta]

because this is a standard, a lib can even work as multiplatform

[Stefan Oltmann]

Ok, I see. You want that all bundled into one lib. Interesting idea.

[Alex Acosta]

we use AppAuth, which is bundled separately

[Alex Acosta]

I can make this to work with expect/actual but will require specific code

[Stefan Oltmann]

I don’t see that existing right now as a lib, but it’s all in Ashampoo Photos.
Maybe I ask if I can bundle that and release it open source similar to how I got permission to release https://github.com/Ashampoo/kim

[Stefan Oltmann]

Thanks for this great idea of another multiplatform library 🙂 👍

[Stefan Oltmann]

A Kotlin Multiplatform lib that’s a binding to AppAuth would be another possible solution.

[Stefan Oltmann]

Fortunately my company is willing to contribute to Kotlin ecosystem ❤️

[Alex Acosta]

Great to hear that, promising future

[Stefan Oltmann]

I can make this to work with expect/actual but will require specific code

If you find time to do that before I do, you even may bundle and publish it as a lib. 😄