notazof/yavsc
1
0
Fork 0
Code Issues Pull requests Projects 1 Releases 3 Packages Wiki Activity Actions

PostIt: switch OIDC client from confidential (client_secret) to public (PKCE/JWT)

Browse source 
PostIt is a desktop/mobile app talking to Yavsc.Org
(https://yavsc.pschneider.fr) as an OIDC identity provider. The
previous grant used the client_credentials flow with a client_secret
embedded in postit-settings.json: this was both insecure (secret
travels with the binary) and inappropriate for an interactive app
(token had no user identity, so the API could not scope or audit).

The new flow is Authorization Code + PKCE:

  * PostIt client (Settings/AuthenticationSettings.cs): the
    ClientSecret property is removed; GetOidcClientOptions now drops
    the secret and accepts an optional IBrowser supplied per-platform.
  * Settings.cs: new AndroidRedirectUri constant ('android://postit-signin')
    that the Android app uses; RedirectUri is no longer hard-coded in
    MainViewModel.
  * MainViewModel.cs: the manual discovery + client_credentials POST is
    replaced with OidcClient.LoginAsync (Authorization Code + PKCE).
  * Settings sample: Authority points at the real Yavsc.Org OP, not at
    a non-existent Keycloak-style realm path.
  * Yavsc.Org/Extensions/HostingExtensions.cs: the 'postit' client seed
    is now idempotent (MigratePostItClientToPublic) and detects
    legacy state on existing ConfigurationDb rows - flips
    RequireClientSecret=false, RequirePkce=true, drops any ClientSecret
    row, and replaces the legacy RedirectUris
    (https://yavsc.pschneider.fr/, yavsc://callback) with the current
    set (http://127.0.0.1:7890/, android://postit-signin).

PostIt.Android:

  * MainActivity: explicit Name attribute so the activity alias can
    target a stable component; LaunchMode.SingleTask so the existing
    instance receives the deep-link Intent; OnNewIntent forwards the
    callback URI through AndroidOidcCallbackSink.
  * AndroidManifest.xml: activity-alias PostIt.Android.OidcCallbackActivity
    exposing scheme=android host=postit-signin to Android, so the OP
    redirect lands back in the running PostIt instance.

The IdentityModel.OidcClient.Browser.SystemBrowser package and a
thin AndroidSystemBrowser implementation are added in a follow-up so
OidcClient.LoginAsync can actually drive Chrome Custom Tabs and
consume AndroidOidcCallbackSink.
This commit is contained in:
Paul Schneider 2026-06-20 17:16:07 +01:00
commit 512a0ef06f
9 changed files with 324 additions and 116 deletions
Download patch file Download diff file Expand all files Collapse all files

33
src/PostIt/PostIt.Android/Properties/AndroidManifest.xml
View file

@ -1,5 +1,32 @@
<?xml version="1.0" encoding="utf-8"?>
<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android" android:installLocation="auto">
<uses-permission android:name="android.permission.INTERNET" />
<application android:label="PostIt" android:icon="@drawable/Icon" />
</manifest>
<application android:label="PostIt" android:icon="@drawable/Icon">
<!--
Deep-link receiver for the OIDC Authorization Code + PKCE flow.
After the user authenticates in the system browser, the OP
redirects to android://postit-signin?... and Android forwards
the Intent to the MainActivity (configured SingleTask so the
existing instance receives OnNewIntent rather than spawning a
new one).
The host value (postit-signin) MUST match the
AndroidRedirectUri constant in PostIt/Settings/Settings.cs and
the corresponding RedirectUri registered for the 'postit'
client in IdentityServer (Yavsc.Org ConfigurationDb).
-->
<activity-alias
android:name="PostIt.Android.OidcCallbackActivity"
android:targetActivity="PostIt.Android.PostItMainActivity"
android:exported="true"
android:launchMode="singleTask">
<intent-filter>
<action android:name="android.intent.action.VIEW" />
<category android:name="android.intent.category.DEFAULT" />
<category android:name="android.intent.category.BROWSABLE" />
<data android:scheme="android" android:host="postit-signin" />
</intent-filter>
</activity-alias>
</application>
</manifest>