1503456 - Please provision oauth credentials for android-components reference browser

Status: RESOLVED FIXED

(Cloud Services :: Server: Firefox Accounts, enhancement)

Description

[Ryan Kelly [:rfkelly]]

We have a bunch of OKRs around adding various app-services functionality into the android-components Reference Browser.  Let's get it set up so that reference-browser can use the production FxA stack rather than a dev environment.

First order of business is to allocate a unique OAuth client_id and get it configured appropriately.  I'll start with making one in the dev environment.

Comment 1

[Ryan Kelly [:rfkelly]]

Here's a PR to add it in the dev environment:

  https://github.com/mozilla/fxa-auth-server/pull/2706

With the following details:

    {
      "id": "3c49430b43dfba77",
      "name": "Android Components Reference Browser",
      "hashedSecret": "a7ee3482fab1782f5d3945cde06bb911605a8dfc1a45e4b77bc76615d5671e51",
      "redirectUri": "https://XXX.TODO.WHAT.GOES.HERE",
      "canGrant": false,
      "trusted": true,
      "allowedScopes": "https://identity.mozilla.com/apps/oldsync",
      "publicClient": true
    }

The id and hashedSecret were generated via:

```
>>> import os
>>> os.urandom(8).encode('hex')
'3c49430b43dfba77'
>>> os.urandom(32).encode('hex')
'a7ee3482fab1782f5d3945cde06bb911605a8dfc1a45e4b77bc76615d5671e51'
```

But we should re-generate a fresh junk hashedSecret for production use.

The one open question I have is, what should we use for the redirectUri?  If I understand correctly, the flow that's currently being used by reference-browser is:

* Use redirectUri="fxaclient://android.redirect"
* Load the FxA OAuth flow in a tab, and let it complete
* Intercept the attempt to redirect to "fxaclient://android.redirect" and:
  * Extract "code" and "state" from the URl
  * Redirect to the FxA page /connect_another_device?showSuccessMessage=true

It would be good to avoid using a custom "fxaclient://" URL scheme, and to simplify the flow here a bit if we can.

Shane, what do you think about us hosting a redirectUri for this purpose on https://accounts.firefox.com to simplify things here?  Something like the following strawman:

* Have reference-browser use redirectUri="https://accounts.firefox.com/oauth/success/3c49430b43dfba77"
* We redirect to this page at the end of the OAuth flow, as normal
* Reference browser can detect the navigation to this URL, and extract code & state from the query params
* We can show our nice "success" message without reference-browser having to redirect to it explicitly

Comment 2

[Shane Tomlinson [:stomlinson]]

I have been hesitant to display relier specific messaging on FxA for fear of every relier wanting their own customization. In the long term, that's a burden I'd rather avoid. OTOH, we already show custom pages for Firefox Sync, and conceptually this is an OAuth variation of Sync.

In other words, yeah, this works.

Comment 3

[Jon Buckley [:jbuck]]

I've created this client in production: https://oauth.accounts.firefox.com/v1/client/3c49430b43dfba77

Comment 4

[Vlad Filippov (:vladikoff)]

This works now AFAIK!