Integration with Zalando App

(Taken from #122)

Current state of findings:

How to share login credentials with iOS Fashion App?

Cases

All the following cases require to be fully implemented in the called app. However, they could be done in different ways (scenarios).

User not logged, not stored credentials

When a user is not logged in the app, and no credentials are stored.

Scenario 1

• Handle login process in the app (to verify credentials inside the app)
• Go forward with “User logged” scenario

Scenario 2

• Open the caller app back with an error to handle as “No credentials are available”.

User not logged, credentials are stored

Scenario 1

Treat it as “User logged."

Scenario 2

Treat it as “User not logged, not stored credentials."

User logged

1. Grab any of credentials:

• Email + password from keychain
• OAuth token (with login and permission)

2. Open back calling app with the acquired data

Possible authentication methods

OAuth access

Scenario

1. App 1 opens App 2 with a request for a token
2. App 2 uses credentials stored in the app to fill in the OAuth form.
3. App 2 retrieves OAuth token
4. App 2 passes OAuth token back to the App 1.

Pros/cons

• 💚 Safe and correct way of handling sensitive data access
• 💚 Gives real OAuth token without additional operations
• 🚫 Requires extra 2 steps for a user inside Fashion App
• 🚫 Requires OAuth implementation in Fashion App
• 🚫 Requires injecting existing credentials into separated OAuth login form

Share real credentials

Scenario

1. App 1 opens App 2 with a request for a token, and secret accessing token
2. App 2 asks for login or directly passes credentials to the App 1 in encrypted form

Pros/cons

• Needs to implement data encryption.
  • Private/public key:
    • 🚫 Requires adding public key to Fashion App and updating it for all the apps
  • Symmetric-key
    • 💚 Allows to encrypt response with a given password, and it could be random OTP
    • 🚫 Requires adding access password/key to open Fashion App to avoid stealing user data
• Data transfer possibilities
  • App-specific uri
  • Save BMP file in Camera Roll
  • 🚫 Named pasteboard (only same app group)

Shared Keychain Access

🚫 NO-GO. All applications that share keychain access must use the same app ID prefix, which is not possible for apps using SDK

App Extension

Like 1password. To be confirmed.

Shared Web Credentials

Important to note: it's possible to share credentials with Safari.

In short it needs:

• specific app setup
• specific web setup (this case login page or Zalando page)
• user acceptance to do it