Question

I’m trying get RestKit (version 0.10.2) to authenticate with OAuth2. I’m using GTMOAuth2 to handle the OAuth interactions.

I’ve successfully gotten GTMOAuth2 to sign me in and make a request to the api I’m using.
I’ve also managed to get RestKit to make a request with my access token with this:

- (void)setRKAuthorizationToken:(NSString *)authorizationToken {
  RKObjectManager* objectManager = [RKObjectManager sharedManager];
  NSString* authHeader = [NSString stringWithFormat:@"Bearer %@", authorizationToken];
  [objectManager.client setValue:authHeader forHTTPHeaderField:@"Authorization"];
}

In this code sample I am manually setting the HTTP header because RestKit’s support for OAuth2 sets the header as Authorization: OAuth2 <accessToken> instead of Authorization: Bearer <accessToken>.

Anyway, this works great until the access token needs to be refreshed with the refresh token.

What I’d really like to do is tell RestKit to use GTMOAuth2Authentication‘s - (BOOL)authorizeRequest:(NSMutableURLRequest *)request; as it automatically fetches a new access token with the refresh token when the access token expires.

BTW, RestKit is phasing it’s support for OAuth; authorizing requests with a third-party library is the suggested approach. I asked for an example and the response pointed me in the direction of classes to subclass, which are in the development branch.

So, the question is: Have you successfully integrated RestKit 0.10.x with GTMOAuth2 or know how to accomplish this?

Answer 1

I’m going to answer my own question here because I have something that works, but it’s not ideal.

Basically I am continuing to sign requests manually, and to deal with the possibility of an expired token, I am using GTMOAuth to authorize a dummy request. The serious downside is that it means an extra request to the api. But, now I know I have a valid access token. Part of the trick is going to be knowing when to call loginWithBaseController:.

Here is the basic concept:

- (void)makeRequestToEnsureAccessTokenSuccess:(void (^)())block error:(void (^)(NSError*))errorBlock {
  NSURL *url = [NSURL URLWithString:@"https://uri/to/a/basic/api/call.json"];
  NSMutableURLRequest *request = [NSMutableURLRequest requestWithURL:url];

  // TODO: Only do this if we need to. It's kind of a waste to refresh the token
  //  all the time.
  [self.gtmoauth authorizeRequest:request completionHandler:^(NSError *error) {
    if (error) {
      errorBlock(error);
    } else {
      [GTMOAuth2ViewControllerTouch saveParamsToKeychainForName:kKeychainItemName accessibility:NULL authentication:self.gtmoauth];
      block();
    }
  }];
}

- (void)loginWithBaseController:(UIViewController *)baseViewController {
  [self loadAuthFromKeyChain];

  if (self.gtmoauth.canAuthorize) {

    [self makeRequestToEnsureAccessTokenSuccess:^{
      NSLog(@"setting RKAuthorizationToken with %@", self.gtmoauth.accessToken);
      [self setRKAuthorizationToken: self.gtmoauth.accessToken];
      [self.delegate authorizationFinished];
    } error:^(NSError* error) {
      [self logout];
      [self showAuthorizationControllerFor:baseViewController];
    }];
  } else {
    [self showAuthorizationControllerFor:baseViewController];
  }
}

Anyway, I am still looking for a better solution. I thought I would post this in case it helps someone else at least through development.