auth0 / lock.swift

A Swift & iOS framework to authenticate using Auth0 and with a Native Look & Feel

📚 Documentation • 🚀 Getting Started • 💬 Feedback

Migrating from v1? Check the Migration Guide.

Documentation

• Examples - explains how to use Lock.swift.
• Auth0 Documentation - explore our docs site and learn more about Auth0.

Getting Started

Requirements

• iOS 9+
• Xcode 13.x / 14.x
• Swift 4.x / 5.x

Lock.swift uses Auth0.swift 1.x.

Installation

Cocoapods

Add the following line to your Podfile:

pod "Lock", "~> 2.24"

Then, run pod install.

Carthage

Add the following line to your Cartfile:

github "auth0/Lock.swift" ~> 2.24

Then, run carthage bootstrap --use-xcframeworks --platform iOS.

Swift Package Manager

Open the following menu item in Xcode:

File > Add Packages...

In the Search or Enter Package URL search box enter this URL:

https://github.com/auth0/Lock.swift

Then, select the dependency rule and press Add Package.

Configure the SDK

Head to the Auth0 Dashboard and create a new Native application.

Lock.swift needs the Client ID and Domain of the Auth0 application to communicate with Auth0. You can find these details in the settings page of your Auth0 application. If you are using a custom domain, use the value of your custom domain instead of the value from the settings page.

Configure Client ID and Domain with a plist

Create a plist file named Auth0.plist in your app bundle with the following content:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>ClientId</key>
    <string>YOUR_AUTH0_CLIENT_ID</string>
    <key>Domain</key>
    <string>YOUR_AUTH0_DOMAIN</string>
</dict>
</plist>

Configure Client ID and Domain programmatically

For Classic Lock

Lock
    .classic(clientId: "YOUR_AUTH0_CLIENT_ID", domain: "YOUR_AUTH0_DOMAIN")
    // ...

For Passwordless Lock

Lock
    .passwordless(clientId: "YOUR_AUTH0_CLIENT_ID", domain: "YOUR_AUTH0_DOMAIN")
    // ...

Configure your app

Make sure Lock.swift can receive callback URLs.

Using the UIKit app lifecycle

// AppDelegate.swift

import Lock

// ...

func application(_ app: UIApplication,
                 open url: URL,
                 options: [UIApplication.OpenURLOptionsKey: Any]) -> Bool {
    return Lock.resumeAuth(url, options: options)
}

Using the UIKit app lifecycle with Scenes

// SceneDelegate.swift

import Lock

// ...

func scene(_ scene: UIScene, openURLContexts URLContexts: Set<UIOpenURLContext>) {
    guard let url = URLContexts.first?.url else { return }
    Lock.resumeAuth(url, options: [:])
}

Next steps

Learn how to use Lock.swift in Examples ↗

• Lock Classic - handles authentication using Database, Social, and Enterprise connections.
• Lock Passwordless - handles authentication using Passwordless and Social connections.

Feedback

Contributing

We appreciate feedback and contribution to this repo! Before you get started, please see the following:

• Auth0's general contribution guidelines
• Auth0's code of conduct guidelines
• Lock.swift's contribution guide

Raise an issue

To provide feedback or report a bug, please raise an issue on our issue tracker.

Vulnerability reporting

Please do not report security vulnerabilities on the public GitHub issue tracker. The Responsible Disclosure Program details the procedure for disclosing security issues.

---

Auth0 is an easy to implement, adaptable authentication and authorization platform. To learn more checkout Why Auth0?

This project is licensed under the MIT license. See the LICENSE file for more info.

lock.swift's Issues

SignUp disclaimer view is not displayed

In A0SignUpViewController the outlet self.disclaimerView is not properly bind in the .xib.

Prepare library for iOS 7

Improve error handling

Issue building Auth0.iOS

Hi,

For some reason, I am having trouble building the examples. There are issues with cocoapod
dependencies (Specifically, Facebook's dependency on Bolts-IOS). I can clone and lint the Facebook SDK and Bolts individually without an issue. Thanks for your help.

Dan

pod lib lint output

Auth0.iOS$ pod lib lint

[!] /usr/bin/git submodule update --init

Submodule 'Bolts-IOS' (git://github.com/BoltsFramework/Bolts-iOS.git) registered for path 'Bolts-IOS'

Submodule 'vendor/OCHamcrest' (git://github.com/hamcrest/OCHamcrest) registered for path 'vendor/OCHamcrest'

Submodule 'vendor/OCMock' (git://github.com/erikdoe/ocmock) registered for path 'vendor/OCMock'

Submodule 'vendor/OHHTTPStubs' (git://github.com/AliSoftware/OHHTTPStubs.git) registered for path 'vendor/OHHTTPStubs'

Submodule 'vendor/appledoc' (git://github.com/tomaz/appledoc.git) registered for path 'vendor/appledoc'

Submodule 'vendor/ios-snapshot-test-case' (git://github.com/facebook/ios-snapshot-test-case.git) registered for path 'vendor/ios-snapshot-test-case'

Submodule 'vendor/xctool' (git://github.com/facebook/xctool.git) registered for path 'vendor/xctool'
Cloning into 'Bolts-IOS'...

fatal: unable to connect to github.com:

github.com[0: 192.30.252.131]: errno=Operation timed out



Clone of 'git://github.com/BoltsFramework/Bolts-iOS.git' into submodule path 'Bolts-IOS' failed

Twitter authentication failing when multiple accounts exist

Testing Auth0 currently and found if you have more than one account active in Twitter when you select the twitter option it just hangs and the loader spins.

After looking at the logs it should be asking the user which account to pick but it never does.

Is this a know issue or do I need to handle this scenario?

2015-04-24 00:36:10:747 TestTwo[1074:807] Authenticating using third party iOS application for strategy twitter
2015-04-24 00:36:10:764 TestTwo[1074:807] Starting Twitter authentication...
2015-04-24 00:36:10:781 TestTwo[1074:807] Requesting access to iOS Twitter integration for Accounts
2015-04-24 00:36:10:862 TestTwo[1074:510b] Obtained 2 accounts from iOS Twitter integration
2015-04-24 00:36:10:862 TestTwo[1074:510b] Asking the user to choose one account from the list...

Sample with Custom UI

Also overriding default scopes and connections.

Add Account Linking

We need to add account linking.

For that, the user will set the access_token as an A0AuthParameter.

It's implemented different in each case:

• In Username/Password ==> Send access_token as part of the /oauth/ro call.
• In Facebook / Twitter ==> Send main_access_token parameter with the access_token set in A0AuthParameter. This call
• For other IdPs (Safari) ==> Send the access_token request parameter.

Carthage Support

• Build Framework
• Upload to releases
• Add info in README

Layout improvements

• Migrate to Storyboards?
• Use Size Classes

iOS 5S / 64 bits "file was built for archive which is not the arch being linked"

It doesn't work on "iOS 5S / 64 bits"

ld: warning: ignoring file /Documents/Auth0.iOS/iAuth0Client/libAuth0Client.a, file was built for archive which is not the architecture being linked (armv7s): /Documents/Auth0.iOS/iAuth0Client/libAuth0Client.a
Undefined symbols for architecture armv7s:
  "_OBJC_CLASS_$_Auth0Client", referenced from:
      objc-class-ref in ProfileViewController.o
ld: symbol(s) not found for architecture armv7s
clang: error: linker command failed with exit code 1 (use -v to see invocation)

reproted by William George first

Delegation not functional / crashes

The responseObject for delegationWithParameters contains the correct data, including the Credentials block, but it's parsed into an A0Token, which asserts on data related to login, not delegation.

Primary button title color cannot be changed using A0Theme

Support EU deployments

Currently the logic uses cdn.auth0.com for all domains ending with auth0.com. But for domains ending with eu.auth0.com we should use cdn.eu.auth0.com:

https://github.com/auth0/Lock.iOS-OSX/blob/756edb04acd09612bdb7ddc0293bb21a9ff5cd68/Pod/Classes/Core/A0APIv1Router.m#L72

Adjust the color and title of the Navigation Bar

How do you adjust the title and color of the navigation bar when presenting the iOS login widget?

Show UIWebView for non-native login

When authenticating with an Identity Provider (e.g. Instagram) that doesn't support native login to use UIWebView. By default it will use Safari.

Support for dynamic fwk

http://blog.cocoapods.org/Pod-Authors-Guide-to-CocoaPods-Frameworks/

• Fix errors with CocoaPods version 0.36.0.beta.1
• Check with stable release of 0.36
• Create example using Dynamic Framework.

Supply optional authentication parameters

When authenticating with any strategy against Auth0 (username/password, facebook, linkedin, etc), there should be a way to supply parameters to be sent in the request. These parameters can be defined in the widget (A0AuthenticationViewController) or in each auth method of A0APIClient.

Alignment Issue

There is an alignment issue when presenting the Auth0 login widget. The horizontal line overlaps the word 'or'.

Move social integrations to an independent pod

• Facebook
• Twitter
• Google+

Add default headers with SDK version for API calls

Check this issue for reference.

Might need to override the iOS default header when using NSURLSession/NSURLConnection, the format is AppName/Version (Device; iOS Version; Scale).
Also check how to do that for UIWebView.

Create Documentation for IdPs APIs

Document the API that would let the developer add a button called Signin with Twitter and would do that bypassing the Widget.

Allow API v2 endpoint to be configurable

Avoid hardcoding API v2 endpoint, it should be the same as Auth0Domain or derived from tenant in the same way we do for Auth API.

Implementent Enterprise Connections

We need to implement Enterprise Connection. The following is the flow explained:

1. If the Auth0 account has AD and Kerberos enabled and the user is inside the same network (IP Range), we just show one button called Sign in With Windows Auth and send him to Safari
2. If the user has NO DB connection enabled and AD, you show a username + password fields and call /ro with the information
3. If the user has a DB connection and AD, you show the regular email + password field. If the email entered matches ANY of the AD connection domains, you change the form so that the user then enters his username and pasword and call /ro with that information.
4. If the user uses any other enterprise connection, when he enters his email, you check to match the domain. If it matches, you hide the password field and change the button to the SSO mode.

HDR reference information

Show error when social connection is not properly configured

Show a specific error message telling the user to configure the connection for the following errors:

• couldn't fetch profile error.
• not enabled in server

  We need to check if there are more errors that can tell us if the connection is not configured.

Post a NSNotification for important Lock events

Related to #37

• Successful/Failed Login
• Successful/Failed Signup
• Successful/Failed Change password
• UIViewController Dismissed by the user

UITheme is using a iOS 8+ API

Replace the inner method -image of A0ImageTheme with the following:

- (UIImage *)image {
    if ([UIImage respondsToSelector:@selector(imageNamed:inBundle:compatibleWithTraitCollection:)]) {
        NSBundle *bundle = self.bundleName ? [NSBundle bundleWithIdentifier:self.bundleName] : [NSBundle bundleForClass:self.class];
        return [UIImage imageNamed:self.imageName inBundle:bundle compatibleWithTraitCollection:nil];
    } else {
        return [UIImage imageNamed:self.imageName];
    }
}

Suggestion: Add default parameters to fetchDelegationTokenWithParameters

It seems that the default parameters that are added in fetchNewIdTokenWithIdToken are also required for fetchDelegationToken. This took some trial and error to figure out, so it would be handy if they were auto-added.

On that note, it would also be helpful to the possible parameters documented.

Thanks for the fast turnaround on the 1.1 update.

Call callback on successful/failed Reset Password

Right now, after password is reseted, callbacks aren't being called. We need to implement this.

Thanks!

Webkit Error

*** WebKit discarded an uncaught exception in the webView:decidePolicyForNavigationAction:request:frame:decisionListener: delegate: *** -length only defined for abstract class. Define -[Auth0User length]!

Option to use WKWebView

Better Swift support

• use Nullability Annotations

Update Facebook SDK

Start using Facebook SDK 4.x for native integration.

Option to ask twice for password on Signup

Add a flag in A0AuthenticationViewController to ask the user to confirm the password on Sign Up.

Tag version number so a podspec can be published

Hi, can you please tag your repo with a version number so that a CocoaPods spec can be published. Thanks!

Native form for ADFS and WAAD connections

Show alert if social integration is missing configuration

When a social native integration requires extra steps and any of those are missing, we should show an alert to the user/dev. (Also el log could be helpful).

• Facebook
• Twitter
• Google+

Show error message returned from a rule

When trying to authenticate a user and a Rule returns an error like:

{
  "error": "unauthorized",
  "error_description": "You need to count to 10 before you can access this application."
}

Show the content of error_description to the user.

Add logout

New customisation keys for A0Theme

• Separate secondary button color with dismiss tint color.
• Add field box background color.
• Primary button custom background images
• Secondary button custom background images
• Title font size
• Message font size

keyboard covers email and password fields

it happens on emulator and real device

App store rejection because of opening Safari

Hi Auth0,
Our app was rejected because it bounced users out to safari when logging in with the google+ auth0 login strategy.

I see -[A0LockViewController useWebView], but we are using -[A0IdentityProviderAuthenticator authenticateForStrategyName:..] because we have custom UI for our login screen.

Is there a way to use auth0 with google+ that keeps users in our app?

Thanks
Alden

Select what connections to use in Lock

Add a way to pick specific connections from your application info and filter the rest.
Something like:

lock.connections = @[@"facebook", @"twitter", @"linkedin"];

Use CocoaPods plugin to store api keys

https://github.com/orta/cocoapods-keys

Functions should return a block (even if there is an error)

Support disableSignupAction and disableChangePassword

Integrate with the Linkedin native application instead of webview

Logging improvements

• Dynamic Log Level
• CocoaLumberjack 2.0

Getting an error when trying to connect via Facebook

unlinkAccountWithUserId uses application client ID, but v1 /unlink API requires global_client_id

We are attempting to use the unlinkAccountWithUserId function, but are getting failures. A manual (javascript) post to https://xxxx.auth0.com/unlink works, but only with clientID set to the users global_client_id (and not self.clientId as implemented in iOS Lock API). xf: https://auth0.com/docs/link-accounts

A0AuthParameters does not implement NSCopying properly

A0AuthParameters does not truly copy its content, its a shallow copy.