Question

我正在进行Auth0集成，我已经在Swift项目中成功集成了Auth0 SDK，但是我想从我的应用程序实现直接登录，而无需重定向到Auth0通用登录页面。

我在这里研究了移动登录流程（https://auth0.com/docs/flows/concepts/mobile-login-flow ）。

我在iOS Swift中实现了Auth0登录，它正在运行。但是我要直接登录。

查看我的屏幕

当我们在我的应用程序中单击登录时，它会弹出。

单击继续，它将打开Auth0.com页面（我不需要此页面，我想直接登录而没有此页面如何？）

我不希望该页面，我希望通过mu应用程序登录页面How?。

有可能吗？。

为此，我点击了此链接https://auth0.com/docs/flows/guides/mobile-login-flow/add-login-using-mobile-login-flow，并实现了 code_verifier和code_challage。。但是，当我实现授权用户时，会得到 html响应。

我的代码是：

func codeVerifier() {
    var buffer = [UInt8](repeating: 0, count: 32)
    _ = SecRandomCopyBytes(kSecRandomDefault, buffer.count, &buffer)
    let verifier = Data(bytes: buffer).base64EncodedString()
        .replacingOccurrences(of: "+", with: "-")
        .replacingOccurrences(of: "/", with: "$_")
        .replacingOccurrences(of: "=", with: "")
        .trimmingCharacters(in: .whitespaces)

    print("Code_Verifier : \(verifier)")

    codeChallenger(verifier: verifier)
}

func codeChallenger(verifier:String) {
    // Dependency: Apple Common Crypto library
    // http://opensource.apple.com//source/CommonCrypto
    guard let data = verifier.data(using: .utf8) else {

        return
    }

    var buffer = [UInt8](repeating: 0,  count: Int(CC_SHA256_DIGEST_LENGTH))
    data.withUnsafeBytes {
        _ = CC_SHA256($0, CC_LONG(data.count), &buffer)
    }
    let hash = Data(bytes: buffer)
    let challenge = hash.base64EncodedString()
        .replacingOccurrences(of: "+", with: "-")
        .replacingOccurrences(of: "/", with: "$_")
        .replacingOccurrences(of: "=", with: "")
        .trimmingCharacters(in: .whitespaces)

    print("Code_Challenger : \(challenge)")

    authorizwTheUser(code_challange: challenge)
}

func authorizwTheUser(code_challange:String) {

    let url = "https://domain.auth0.com/authorize?"

    var request = URLRequest(url: URL(string: url)!)

            request.setValue("application/json", forHTTPHeaderField: "Content-Type")
            request.httpMethod = "GET"

            print("URL : \(request)")

    let parameters = "response_type=token&code_challenge=\(code_challange)&code_challenge_method=S256&client_id=&redirect_uri=com.myappname.Auth0DemoSwift://domainname.auth0.com/ios/com.domainname.Auth0DemoSwift/callback&scope=openid profile&state=xyzABC123x"

    request.httpBody = parameters.data(using: .utf8)

    print(parameters)

            let task = URLSession.shared.dataTask(with: request) { data, response, error in guard let data = data, error == nil else { // check for fundamental networking error
                print("error=\(String(describing: error))")
                return
                }

                if let httpStatus = response as? HTTPURLResponse, httpStatus.statusCode != 200 { // check for http errors
                    print("statusCode should be 200, but is \(httpStatus.statusCode)")
                    print("response = \(String(describing: response))")
                }

                                            // If Response is in String formate
                                            let responseString = String(data: data, encoding: .utf8)
                                            let dictionary = data
                                            print("dictionary = \(dictionary)")
                                            print("responseString = \(String(describing: responseString!))")

                do {
                    let response = try JSONSerialization.jsonObject(with: data, options: .allowFragments) as? [String: AnyObject]
                    print(response!)

                    let res = response!["Response"]
                    let status = res!["status"] as! String

                    if status == "SUCCESS" {

                    } else {

                    }

                } catch let error as NSError {
                    print(error)
                }
            }

            task.resume()

}

Answer 1

如果要避免显示同意屏幕并重定向到auth0托管的登录页面，则可以将身份验证API与密码领域（http://auth0.com/oauth/grant-type/password-realm）授予类型一起使用。缺点是：

没有SSO
您需要开发自己的UI
易于使用暴力攻击（在仪表板中启用暴力保护）

如上所述：

The Authentication API exposes AuthN/AuthZ functionality of Auth0, as well as the supported identity protocols like OpenID Connect, OAuth 2.0, and SAML. We recommend using our Hosted Login Page but if you wish to build your own UI you can use our API endpoints to do so. However some Auth flows (Grant types) are disabled by default so you will need to enable them via your Auth0 Dashboard as explained in this guide.

登录：

Auth0 .authentication() .login( usernameOrEmail: "support@auth0.com", password: "secret-password", realm: "Username-Password-Authentication", scope: "openid") .start { result in switch result { case .success(let credentials): print("Obtained credentials: \(credentials)") case .failure(let error): print("Failed with \(error)") } } 注册：

Auth0 .authentication() .createUser( email: "support@auth0.com", password: "secret-password", connection: "Username-Password-Authentication", userMetadata: ["first_name": "First", "last_name": "Last"] ) .start { result in switch result { case .success(let user): print("User Signed up: \(user)") case .failure(let error): print("Failed with \(error)") } } 它记录在这里：https://github.com/auth0/Auth0.swift#authentication-api-ios--macos--tvos

如何在没有重定向通用登录页面的情况下直接在Auth0中登录？

1 个答案: