Adding Modern Authentication (OAuth2) to Mobile Apps

Modern Authentication is the term Microsoft uses to refer to its implementation of the OAuth 2.0 authorization framework for client/server authentication. Modern Authentication leverages standard authentication libraries to enable applications to support single sign-on (SSO) features like 2FA/MFA and to use access and refresh tokens to validate authentication requests.

This KB article provides step-by-step instructions to add Microsoft Modern Authentication to any Android or iOS app without code or coding.

Adding Modern Authentication (OAuth2) to Mobile Apps Without Coding

Appdome is a mobile integration platform as a service (iPaaS) that allows users to add a wide variety of features, SDKs, and APIs to Android and iOS apps. Using a simple ‘click to add’ user interface, Appdome allows anyone to easily integrate Microsoft Modern Authentication to any mobile app – instantly, no code or coding required.

Using Appdome, there are no development or coding prerequisites. For example, there is no Appdome SDK, libraries, or plug-ins to implement. Likewise, there are no required infrastructure changes and no dependency on SAML, OAuth, OpenID Connect or any other authentication standard inside the app.  Users merely upload mobile apps, select the Mobile Enterprise Authentication by Appdome service and click “Build My App.” The Appdome technology adds Modern Authentication and relevant standards, frameworks and more to the app automatically, with no manual development work at all.

The following diagram illustrates the Single-Sign-On flow for apps that have been integrated with Modern Authentication (OAuth2).

1. The application sends an unauthorized request to reach a resource like internal.mycomp.com which is protected by a gateway, AD, or the app server itself.
2. The server protecting the resource responds with 401 or 30X response since the request is not authorized.
3. Appdome identifies the response from the protected resource and opens an internal Webview within the Built App
4. The internal Webview navigates to the Hub URL (e.g. https://company-portal-url.com/api/portal.html)
5. The user can now authenticate using any authentication method the hub URL requires, during the authorization session, the cookies and authorization token are received
6. The Azure server redirects to the Success URI (e.g. https://successful-authentication-internal-url/portal.html) since the authorization succeeded. Note that the app’s Success URI is configured on Azure should match the configuration during fusion.
7. Appdome identifies the Success URI redirect and closes the internal Webview, returning the view to the original app.
8. Now, when the app tries to reach the protected resource, the authorization header or cookies are attached to the outgoing request. The gateway will trust these credentials and the app will reach the protected resource internal.mycompany.com successfully.

Prerequisites for Using Appdome for Modern Authentication

In order to use Appdome’s no code implementation of Microsoft Modern Authentication authentication, you’ll need:

• Appdome account
• Mobile App (.ipa for iOS, or .apk or .aab for Android)
• AD Hub URL
• Authentication Successful URI on AD
• Application protected resource URL
• Signing Credentials (e.g., signing certificates and provisioning profile)

How to Add Modern Authentication to Any Mobile App on Appdome

1. Upload a Mobile App to Your Account

   Please follow these steps to add a mobile app to your Appdome account.
   If you don’t have an Appdome account, click here to create an account.

   From the “Build” tab, select Authentication

2. Under the Authentication Profiles, open the Select Scheme drop-down list, select Mobile Enterprise Authentication by Appdome
3. Add the Protected Resources
4. Add the Authentication Portal URL
5. Add Redirect URIs
6. If your deployment uses Open ID, Enable OpenID Authentication
   • If your deployment requires additional HTTP modifiers to authenticate (optional), upload a file
   • The file should be a text file with each row containing a header to add(with + as the first character) or to remove (with – as the first character). e.g:
     +Connection: Keep-Alive
     “-Content-Encoding: gzi”
   • Enter Client ID
7. Enable Cross-App ID (optional).  The Cross-App ID allows the Built app to share the authentication state for Single Sign-On.
8. Click Build My App  

Gil Hartman