Question

I’m writing an Android app which will authenticate itself using OAuth2 to a Web server under my control.

I’m using Apache Amber on the client side, and oauth2app with Django on the server side.

From the client, I can generate an authorization request, and start a browser Activity that goes to a page asking whether to allow the client access, and after answering in the affirmative, redirects to a page with a “code” parameter.

But how do I get the “code” back to my client, in order to make the subsequent access_token request?

Do I need to bypass the browser entirely? How would that work?

Answer 1

I found a different blog post, specific to OAuth 2:

http://blog.doityourselfandroid.com/2011/08/06/oauth-2-0-flow-android/

The trick is to fire up a new Activity whose content is provided by a WebView (rather than a layout). You can attach a handler to the WebView that’s called on the redirect to the page containing the “code” parameter.

Some of the specifics in the blog post concern Google APIs, but so far my experiments suggest that it will work in my situation.