Retrieve refresh token

To get a new refresh token, present a biometric challenge to the user.

• Android
• iOS

Set up utility methods to use the KeyguardManager as a challenge for device authentication.

private static final int REQUEST_CODE_CREDENTIALS = 1000;
...
...
private boolean isKeyguardSecure() {
    KeyguardManager keyguardManager =
        (KeyguardManager) getSystemService(Context.KEYGUARD_SERVICE);
    return keyguardManager.isKeyguardSecure();
}

private void showKeyguard() {
    KeyguardManager keyguardManager =
        (KeyguardManager) getSystemService(Context.KEYGUARD_SERVICE);
    Intent intent = null;
    if (android.os.Build.VERSION.SDK_INT >= android.os.Build.VERSION_CODES.LOLLIPOP) {
        intent = keyguardManager.createConfirmDeviceCredentialIntent("Confirm credentials", "");
    }
    if (intent != null) {
        startActivityForResult(intent, REQUEST_CODE_CREDENTIALS);
    }
}

We require device authentication every time the user leaves the app, so put that check in onResume:

@Override
protected void onResume() {
    super.onResume();
    if (webAuth.getSessionClient.isAuthenticated() &&
        !keyguardEncryptionManager.isUserAuthenticatedOnDevice()) {
            showKeyguard();
        }
    }

Then, use the refresh token to get a new access token.

• Android
• iOS

Override onActivityResult to get the results from the Keyguard.

@Override
    protected void onActivityResult(int requestCode, int resultCode, Intent data) {
        if (requestCode == REQUEST_CODE_CREDENTIALS && resultCode == RESULT_OK) {
            if (keyguardEncryptionManager.getCipher() == null) {
                keyguardEncryptionManager.recreateCipher();
            }
        } else {
            webAuth.handleActivityResult(requestCode, resultCode, data);
        }
    }

After RESULT_OK is returned, the device is authenticated and keyguardEncryptionManager is able to decrypt all of the encrypted data, including the access and refresh tokens.

Next: Next steps