Embedded Flutter Web with existing Session - Silent Auth / SSO / prompt=none ?

[rokk4]

Hello @ahmednfwela,

First off, I want to say your package is impressive; the code is organized and easy to follow. Great job! 👍

Our Project Setup:

• We have a web application built with Laravel that uses OIDC (OpenID Connect) for authentication, with Keycloak as our identity provider (IDP).
• Separately, we have a mobile application developed in Flutter. This app also authenticates using the same IDP (Keycloak), but it's registered as a different client from the web app.

What We Want to Do:

• We're planning to integrate the Flutter app into our existing Laravel web app as a Flutter Web component. This means users who are already logged in to the Laravel app would then access the embedded Flutter Web app without having to log in again.

Our Challenge:

• We want to avoid making the user log in again when they move to the embedded Flutter Web app.

Potential Solutions:

1. Single Sign-On (SSO) with Silent Authentication: Could we implement a solution where the user doesn't have to log in again, possibly using a method called "silent authentication" (where the system checks if the user is already logged in without prompting them to log in again)? Is this something your package supports?
2. Session Injection: Another idea is to pass the login session from the Laravel app to the Flutter app using JavaScript. This way, the Flutter app knows the user is already logged in. Is there a way to do this with your package? For example, could we manually update the session storage to reflect the user's logged-in status?

Preference:

• Ideally, we'd like to avoid the second option (session injection) if possible.

Thanks for any guidance you can provide!

Kind regards,

[ahmednfwela]

Hello @rokk4 , Glad you are enjoying the package!
I believe the feature you are requesting is similar to what this method does

oidc/packages/oidc/lib/src/managers/user_manager.dart

Lines 1092 to 1111 in 4e9fbac

	Future<OidcUser?> _reAuthorizeUser() async {
	try {
	final user = await loginAuthorizationCodeFlow(
	promptOverride: ['none'],
	options: const OidcPlatformSpecificOptions(
	web: OidcPlatformSpecificOptions_Web(
	navigationMode:
	OidcPlatformSpecificOptions_Web_NavigationMode.hiddenIFrame,
	),
	),
	);
	return user;
	} on OidcException catch (e) {
	if (e.errorResponse != null) {
	await forgetUser();
	return null;
	}
	rethrow;
	}
	}

without prompting them to log in again is what prompt: none is for I believe

according to spec:

prompt: none
The Authorization Server MUST NOT display any authentication or consent user interface pages. An error is returned if an End-User is not already authenticated or the Client does not have pre-configured consent for the requested Claims or does not fulfill other conditions for processing the request. The error code will typically be login_required, interaction_required, or another code defined in Section 3.1.2.6. This can be used as a method to check for existing authentication and/or consent.

and navigationMode: OidcPlatformSpecificOptions_Web_NavigationMode.hiddenIFrame makes sure the user doesn't see any redirection artifacts (tab instantly appearing then disappearing) during silent authentication