Hydra: Native logins and bypassing the OAuth login

[RichardLindhout]

Is your feature request related to a problem? Please describe.

For public clients I think 'app people' would like a more direct approach without opening web pages to keep a smooth experience in-app.

Describe the solution you'd like

My email and password and getting back access_token and refresh_token.
And would be nice if native logins works too of all common platforms:

• Native Facebook login token? returns access_token and refresh_token
• Native Google token? return access_token and refresh token

Describe alternatives you've considered

Using the PKCE public client browser screen in my app.

Additional context

Most major apps don't show a webpage in their app but a native login

[aeneasr]

The apps you cited do not use OAuth2 for solving login, which is why it works there without browser interaction.

You can not strip the browser from OAuth2, it is not possible. If you don’t want browser interaction, it’s the wrong technology. Give ORY Kratos a spin, sounds like that might be a better fit for what you’re up to! :)

On 2. Jul 2020, at 20:31, Richard Lindhout [e-mail] wrote:


Is your feature request related to a problem? Please describe.

For public clients I think 'app people' would like a more direct approach without opening web pages to keep a smooth experience in-app.

Describe the solution you'd like

My email and password and getting back access_token and refresh_token.
And would be nice if native logins works too of all common platforms:

Native Facebook login token? returns access_token and refresh_token
Native Google token? return access_token and refresh token
Describe alternatives you've considered

Using the PKCE public client browser screen in my app.

Additional context

Most major apps don't show a webpage in their app but a native login

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or unsubscribe.

[RichardLindhout]

I agree overall the system is pretty impressive I'll try to integrate with the system in the future.

I think @tacurran was referring the other flow. Like what if you want to provide a Native SDK to third parties so they don't have to show a WebView. I'm don't need this, but maybe it would be a nice feature.

[aeneasr]

Unfortunately, not using a WebView is technologically impossible or extremely terrible security-wise when integrating with OAuth2/OpenID Connect. We'll try to have native SDKs for ORY Kratos though!

Closing this :)