Configure Android apps for OIDC login

This section describes how to configure your Ping SDK for Android application to use centralized login by leveraging the AppAuth library:

Add the build dependency to the build.gradle file:
```
implementation 'net.openid:appauth:0.11.1'
```
Associate your application with the scheme your redirect URIs use.

To ensure that only your app is able to obtain authorization tokens during centralized login we recommend you configure it to use Android App Links.

If you do not want to implement Android App Links, you can instead use a custom scheme for your redirect URIs.
- Android App Links
- Custom Scheme
Complete the following steps to configure App Links:
In your application, configure the AppAuth library to use the HTTP scheme for capturing redirect URIs, by adding an <intent-filter> for AppAuth.RedirectUriReceiverActivity to your AndroidManifest.xml:

AndroidManifest.xml

<activity android:name="net.openid.appauth.RedirectUriReceiverActivity" android:exported="true" tools:node="replace"> <intent-filter android:autoVerify="true"> <action android:name="android.intent.action.VIEW" /> <category android:name="android.intent.category.DEFAULT" /> <category android:name="android.intent.category.BROWSABLE" /> <data android:scheme="https" /> <data android:host="android.example.com" /> <data android:path="/oauth2redirect" /> </intent-filter> </activity>

You must set android:autoVerify to true. This instructs Android to verify the against the assetlinks.json file you update in the next step.

Specify the scheme, hosts, and path parameters that will be used in your redirect URIs. The host value must match the domain where you upload the assetlinks.json file.

To learn more about intents, refer to Add intent filters in the Android Developer documentation.

To learn more about redirects and the AppAuth library, refer to Capturing the authorization redirect.

For Android 11 or higher, add the following to the AndroidManfest.xml file:

<queries> <intent> <action android:name="android.intent.action.VIEW" /> <category android:name="android.intent.category.BROWSABLE" /> <data android:scheme="https" /> </intent> </queries>

Create or update a Digital Asset Links (assetlinks.json) file that associates your app with the domain.

You must host the file in a .well-known folder on the same host that you entered in the intent filter earlier.

The file will resemble the following:

https://android.example.com/.well-known/assetlinks.json

[ { "relation": [ "delegate_permission/common.handle_all_urls", ], "target": { "namespace": "android_app", "package_name": "com.example.app", "sha256_cert_fingerprints": [ "c4:15:c8:f1:...:fe:ce:d7:37" ] } } ]

To learn more, refer to Associate your app with your website in the Android Developer documentation.

Upload the completed file to the domain that matches the host value you configured in the earlier step.

For information on uploading an assetLinks.json file to an Advanced PingOne Advanced Identity Cloud instance, refer to Upload an Android assetlinks.json file.

Add the following to the strings.xml file:

<string name="forgerock_oauth_redirect_uri" translatable="false">https://android.example.com/oauth2redirect</string>

Add the App Link to the Redirection URIs property of your OAuth 2.0 client. For example, https://android.example.com/oauth2redirect
Complete the following steps to configure a custom scheme:
Configure the AppAuth library to use the custom scheme for capturing redirect URIs by using either of these two methods:

Add the custom scheme your app will use to your build.gradle file:

android.defaultConfig.manifestPlaceholders = [ 'appAuthRedirectScheme': 'com.forgerock.android' ]

Or:

Add an <intent-filter> for AppAuth.RedirectUriReceiverActivity to your AndroidManifest.xml:

<activity android:name="net.openid.appauth.RedirectUriReceiverActivity" tools:node="replace"> <intent-filter> <action android:name="android.intent.action.VIEW"/> <category android:name="android.intent.category.DEFAULT"/> <category android:name="android.intent.category.BROWSABLE"/> <data android:scheme="com.forgerock.android"/> </intent-filter> </activity>

For more information, refer to Capturing the authorization redirect.

For Android 11 or higher, add the following to the AndroidManfest.xml file:

<queries> <intent> <action android:name="android.intent.action.VIEW" /> <category android:name="android.intent.category.BROWSABLE" /> <data android:scheme="com.forgerock.android" /> </intent> </queries>

Configure your application to use the redirect URI, either in the strings.xml file, or by using FROptions:

strings.xml:

<string name="forgerock_oauth_redirect_uri" translatable="false">org.forgerock.demo://oauth2redirect</string>

FROptions:

let options = FROptions( ..., oauthRedirectUri: "org.forgerock.demo://oauth2redirect", ..., )

Add the custom scheme to the Redirection URIs property of your OAuth 2.0 client. For example, org.forgerock.demo://oauth2redirect

Configure your application to use browser mode:

// Use FRUser.browser() to enable browser mode:
FRUser.browser().login(context, new FRListener<FRUser>());

// Use standard SDK interface to retrieve an AccessToken:
FRUser.getCurrentUser().getAccessToken()

// Use standard SDK interface to logout a user:
FRUser.getCurrentUser().logout()

The SDK uses the OAuth 2.0 parameters you configured in your application.

You can amend the example code above to customize the integration with AppAuth; for example, adding OAuth 2.0 or OpenID Connect parameters, and browser colors:

 FRUser.browser().appAuthConfigurer()
     .authorizationRequest(r -> {
         // Add a login hint parameter about the user:
         r.setLoginHint("demo@example.com");
         // Request that the user re-authenticates:
         r.setPrompt("login");
     })
     .customTabsIntent(t -> {
         // Customize the browser:
         t.setShowTitle(true);
         t.setToolbarColor(getResources().getColor(R.color.colorAccent));
     }).done()
     .login(this, new FRListener<FRUser>() {
         @Override
         public void onSuccess(FRUser result) {
             //success
         }

         @Override
         public void onException(Exception e) {
             //fail
         }
     });

Ping SDKs

Configure Android apps for OIDC login