Creating a Secure Login on Android using OAuth

With an estimated 4.55 billion people having at least one social media profile as of January 2022, it comes as no surprise that a majority of applications have some sort of social sign-in as an easy way for their users to get onboard. This is key in enhancing the user experience. From a development perspective, there is a major commonality between all these social sign-in providers, like Facebook, Twitter, and Google. That common puzzle piece is OAuth, more specifically OAuth 2.0. But it's not just about using OAuth, it requires the correct understanding of scopes, OAuth Client ID, and the OAuth consent screen for optimal implementation.

What is the difference between Authentication and Authorization?

Authentication (authn) refers to the process of identifying or verifying the user, in this context, it can be done via Google OAuth. On the other hand, authorization (authz) concerns whether the authenticated user has the _permissions needed_ to access a particular resource. This is where scopes play a crucial role as they define the permissions in OAuth.

Both authn and authz are tightly related and typically are found within the OAuth 2.0 process. For both parts of the process, we’re going to need a server to keep our client ID and client secret, which can be managed using Google Cloud.

How Authn and Authz fit into OAuth

OAuth is strictly the standard for authorization, a major misconception among developers is that authn (authentication) is a part of it. OAuth 2.0 also incorporates authn, especially on social platforms like Google, where the processes are run in succession using a combination of native technologies, Javascript, or Kotlin.

Here is an overview of the process:

As you can see, there are two primary components. Initially, we need to have the required authorization from the user. This happens if the user is signed in, this is where a lot of APIs will tie in the authentication piece of OAuth using openid. Once we get the grant from the user account authority, we can start communicating with the resource owner. Upon sending the grant to the authorization server, we receive an access token back. Now, with the access token, we can access the information we need related to the user.

When implementing the OAuth 2.0, it is crucial to set up the correct redirect URIs and callback as any minor mistake in these parameters can result in failure of the authn and authz process. Furthermore, as part of enhancing security and user experience, Google provides the chrome extension for OAuth 2.0.

Authenticating with Google Sign-in on Android

Authenticating applications for Android, particularly with Google sign-in, is a common security measure. But it's not just about adding Google to your Android application, it begins with understanding the OAuth, and then digging into the SDK and Google API.

To get started with Google Sign-in, we'll use Functions, a feature of PubNub which serves as our server. These functions will make the implementation of notifications in the OAuth process simpler. The code snippets for the OAuth process can also be found on GitHub.

In addition, ensure you have your Google API account set up with the correct package name and have your OAuth Client ID and OAuth Consent Screen configured.

Next, we're going to add Google to our Android application so that we can start the sign-in process. First, ensure you have the line repositories { google() } in your project-level Gradle file. This will open up your application to leverage the Google SDK.

Then, head over to the app level Gradle file and update the Google Play services auth dependency. As of January 2022, the most recent version is com.google.android.gms:play-services-auth:19.2.0.

Now, even though we have the updated dependency added to our project, we won't be able to go through the sign-in process just yet. You need to edit the Android manifest file to add the Internet permissions concerning Firebase:

Adding the Google Sign-in Button

This stage is fairly straightforward. Add the sign-in component to the activity_main.xml file. The sign-in button is styled by Google, but check out Google’s brand guidance just in case. Remember, good user experience is key in desktop apps and this includes the stylings and identifiers used on the sign-in button.

In Android apps, authenticating with Google Sign-in is a common security measure. Here, you can see an example of how this process works in the MainActivity. This snippet serves as a guide for implementing Google sign-in using Kotlin.

With the above code, your app is now capable of authenticating and verifying a user! After successful authentication, the next step involves retrieving the Access token. This process is quite similar to the previous one, but this time, you'll submit a HTTP POST request to the token URL – https://www.googleapis.com/oauth2/v4/token. This can be done using JavaScript and the code can be found on GitHub for reference.

Your PubNub Function might resemble the following:

Remember, you need to obtain the authorization code from your Android end-user which you could accomplish by adding this code to your MainActivity.kt file:

And with that, you are well on your way to implementing Google sign-in using OAuth 2.0 in your Android app, keeping the user experience smooth and the app secure.

After testing your application with the open internet, you should be able to navigate through the entire sign-up process without any issues. This process might involve Google OAuth for authentication, which comes with a variety of scopes, or permissions, that can be set for your app. Remember, the user experience should be seamless.

Now that you've gone through all the steps, you should have a better understanding of the difference between OAuth client ID-based authentication and authorization. Building on this knowledge, you can start exploring what you can do after a user signs in through the OAuth consent screen.

The package name in your client-side SDK, be it JavaScript, Kotlin, or native to a different platform, should match the one registered on your Google Cloud project. If any external content isn't accessible on this page, you can also view it at https://pubsub-quickstart-app.pubnub.com/signup. This page should demonstrate the correct usage of the redirect URIs and callback parameters required for OAuth.

In need of PubNub's assistance?

Our platform, offers developers the resources to build, deliver, and manage real-time interactivity for web apps, mobile apps, desktop apps, and IoT devices. Engage users with notifications or create private Firebase applications with unique identifiers for advanced interactions.

The backbone of our platform is the industry's largest and most scalable real-time edge messaging network. Powered by Google Cloud services and integrated with Chrome for additional capability, it's complete with over 15 points-of-presence worldwide, supporting 800 million monthly active users, and a reliability of 99.999%, you won't have to worry about outages, concurrency limits, or latency issues due to traffic spikes.

How to start with PubNub

Familiarize yourself with the core concepts behind every PubNub-powered app in less than 5 minutes by checking out the Live Tour. OpenID can be an important part of these concepts. Sign up for a PubNub account for instant access to PubNub keys for free. The PubNub docs will guide you through the installation and setup process, including the code snippets or "snippets" with detailed parameters, regardless of your use case or preferred SDK.