Embedded App SSO via Token Brokering in Native Web Views
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Web applications embedded within a native application, such as a Web View, lack session state, cookie, or authentication token, necessitating a separate sign-in process, leading to a fragmented user experience due to 'double sign-in' requirements.
Innovation Solution
A hub application performs token brokering on behalf of the embedded application, obtaining and sharing access tokens to enable single sign-on (SSO) across both applications, utilizing a token broker platform and communication bridge to facilitate seamless authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a Web View is used to embed web applications within a native application, then the application can render web-based content in the context of the native application, but the embedded application lacks session state, cookie, or authentication token, requiring a separate sign-in process
Solution Approach 1:
A token broker is introduced as an intermediary component that receives authentication tokens from the native application and provides them to the embedded web application. This mediator enables the embedded application to inherit authentication state without requiring users to sign in again, thus resolving the contradiction between embedding capability and authentication simplicity.
2Reliability
If the embedded application performs independent authentication, then it can maintain its own security state, but the user experience becomes fragmented due to 'double sign-in' requirements
Solution Approach 1:
The authentication token is obtained in advance by the native application and stored in the token broker before the embedded application needs it. When the embedded application requires authentication, the token is already available and can be quickly provided without requiring the user to sign in again, thus maintaining security while reducing authentication time.
3Reliability
If the Web View is rendered in-process without access to a globally shared system cookie jar, then it can maintain process isolation and security, but it cannot share authentication state with other applications
Solution Approach 1:
The authentication state management is segmented into separate components: the native application maintains its authentication state securely, the token broker acts as an intermediate storage and distribution point, and the embedded application receives tokens as needed. This segmentation allows process isolation to be maintained while enabling authentication state sharing through the broker.
Data Source
AI summary
Techniques for enabling a hub application to perform token brokering on behalf of an embedded application, which is embedded in the hub application, to thereby hydrate an authentication state for the embedded application are disclosed. An authentication sign-in event is performed to authenticate a hub application with an account. As a result, the hub application receives, from a token broker platform, a first access token that represents a hydrated authentication state with the account. An embedded application is launched. While refraining from performing a subsequent authentication sign-in event, the hub application performs token brokering on behalf of the embedded application. The hub application sends a second access token to the embedded application.