What is the best practice to switch accounts without re login? #367
Comments
|
If you do not want the login activity to ever appear you will want to set an AuthenticationRefreshProvider either globally in BoxAuthentication or locally in your session. Then you can decide what to do when launchAuthUi is called. If you are still using our login UI for the beginning login and to handle log out situations you can provide an AuthStorage implementation in BoxAuthentication. This will allow you to store and retrieve users from your database instead of our default shared pref based implementation. |
|
So according to you, my logic of storing and refreshing tokens is not enough to prevent login screen appears? |
|
So I try to understand the logic of your sdk: Can you tell me where is the code that triggers the account selection view (with the toast: "you have been logged out")? As you can see, the listview has 2 empty cells and the 3rd one does not correspond to the account concerned. if the user clicks on an "empty" cells the application crash with a nullpointer. So can yo help me to intercept the log out and see what I can do with the authStorage , or to fill this list only with the right account? Thank you for your patient |
|
The reason you are seeing the choose account UI is because the BoxSession object is being constructed with null for the user id. This has a special meaning to the session object, being that the user id will be chosen by the user and so when authenticate is called the UI is shown so that the user chooses which user to authenticate. If you want to login a particular user, you can just specify the userId in which case the logic will get the required access and refresh tokens from the LocalAuthStorage implementation (default to shared prefs). By default if the BoxSession is constructed with just the context it will default to the last authenticated user. You will want to call BoxAuthentication.setAuthStorage sometime early in the lifetime of your application, ideally inside of your application's onCreate flow. At that point the SDK will refer to your implementation of this class to populate the UI. I assume what has happened is that some odd values have been put into your shared prefs which has caused the empty cells and the unknown account. |
|
OK... mBoxSession = new BoxSession(getActivity(),userId);//<--- that i stored during account's creation
mBoxSession.authenticate().addOnCompletedListener(new
BoxFutureTask.OnCompletedListener<BoxSession>() {
@Override
public void onCompleted(BoxResponse<BoxSession> response) {//<--- never returned
if (response.isSuccess()) {
// if success i do my stuff
} else {
// if not i call onRefreshed
onRefreshed(mBoxSession.getAuthInfo());
}
}
}); Yes but in this case the onCompleted is never returned? So I do without: activity.mBoxSession = new BoxSession(getActivity(),mBoxUserId);
activity.mBoxSession.setSessionAuthListener(FragmentClouds.this);//<----FragmentClouds implements
//the listener (onRefreshed, onFailure ,onAuthCreated...etc
//do my stuffIt works .... but when the refrestime has expired and I want to reconnect, nothing happens. the login UI does not appear at all ??? and i obtain the system:out:
and:
401 unauthorised? the catch (BoxException e) {
e.printStackTrace()
}catch nothing. What i am doing wrong? I don't understand why is so tricky to switch between accounts :(( |
|
Generally shouldn't be, we use the SDK in our application. Are you still using your database to keep any refresh/access tokens or did you logout any of the users? It looks like the api call being made is for a different account 221113241 in this case. Logout will invalidate both the access and refresh tokens for a given user so it is likely that is the cause of the error. After setting mBoxSession to your new BoxSession with the 250xxx610 you have to recreate any BoxApi objects you are using to make requests. The SDK is designed to allow you to make api calls in parallel with multiple users, you just need to construct your api objects with the session tied to the user you want. Based off your log the call is being made for a different user. |
|
My goal like with other cloud providers that I use, is to move from one account to another without having to identify me again once the creation is done. So with the latest version I used, ie by building the session with the userid new BoxSession (context, userId), and never calling logout ... is there a reason for the sdk Logout himself? Whenever I build a BoxSession with the userId, of course I rebuild FileApi and FolderApi with the new session. So can you confirm that by doing this: //click to connect account 1
mBoxSession = null;
mFileApi = null;
mFolderApi = null
mBoxSession = new BoxSession(getActivity(),userId1);
mFileApi = new FileApi(mBoxSession)
mFolderApi = new FolderApi(mBoxSession)
// build my list of items account 1
//click to connect account 2
mBoxSession = null;
mFileApi = null;
mFolderApi = null
mBoxSession = new BoxSession(getActivity(),userId2);
mFileApi = new FileApi(mBoxSession)
mFolderApi = new FolderApi(mBoxSession)
// build my list of items account 2it's enough to go from one account to another and I would not log out with the toast "you have been logged out"? and so in this case no more listener is useful? What is strange is that it works for a given time the refreshtime? |
|
Logout is a security measure. It invalidates tokens on the server side, and
removes the app from the logged in list in the user's account.
One possible reason for some of your issues could be the listener you are
setting is based on a shared activity. Even though you are replacing the
pointer for your previous session, the listener for it can still be called
as the logic is based on weak references and the OS doesn't need to clean
it up.
Your shared listener logic needs to differentiate different users, or you
need multiple listeners.
…On Fri, Jun 15, 2018, 3:14 PM Aristide13 ***@***.***> wrote:
My goal like with other cloud providers that I use, is to move from one
account to another without having to identify me again once the creation is
done.
So with the latest version I used, ie by building the session with the
userid new BoxSession (context, userId), and never calling logout ... is
there a reason for the sdk Logout himself?
Whenever I build a BoxSession with the userId, of course I rebuild FileApi
and FolderApi with the new session.
So can you confirm that by doing this:
//click to connect account 1
mBoxSession = null;
mFileApi = null;
mFolderApi = null
mBoxSession = new BoxSession(getActivity(),userId1);
mFileApi = new FileApi(mBoxSession)
mFolderApi = new FolderApi(mBoxSession)// build my list of items account 1
//click to connect account 2
mBoxSession = null;
mFileApi = null;
mFolderApi = null
mBoxSession = new BoxSession(getActivity(),userId2);
mFileApi = new FileApi(mBoxSession)
mFolderApi = new FolderApi(mBoxSession)// build my list of items account 2
it's enough to go from one account to another and I would not log out with
the toast "you have been logged out"? and so in this case no more listener
is useful?
What is strange is that it works for a given time the refreshtime?
—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
<#367 (comment)>,
or mute the thread
<https://github.com/notifications/unsubscribe-auth/AM2YsJx6wCPqvDSQiFZAJaN3gEG2oSjoks5t9DHGgaJpZM4UmPP0>
.
|
|
OK @dblankety //click item1 to connect account 1
mUserId = item1.getUserId();
activity.mBoxSession.setSessionAuthListener(null);
mBoxSession = null;
mFileApi = null;
mFolderApi = null
mBoxSession = new BoxSession(getActivity(),mUserId);
activity.mBoxSession.setSessionAuthListener(listener);
mFileApi = new FileApi(mBoxSession)
mFolderApi = new FolderApi(mBoxSession)
// build my list of items account 1
//click item2 to connect account 2
mUserId = item2.getUserId();
activity.mBoxSession.setSessionAuthListener(null);
mBoxSession = null;
mFileApi = null;
mFolderApi = null
mBoxSession = new BoxSession(getActivity(),mUserId);
activity.mBoxSession.setSessionAuthListener(listener);
mFileApi = new FileApi(mBoxSession)
mFolderApi = new FolderApi(mBoxSession)
// build my list of items account 2
...........
BoxAuthentication.AuthListener listener = new BoxAuthentication.AuthListener() {
@Override
public void onRefreshed(BoxAuthentication.BoxAuthenticationInfo info) {
// or if i get the same listener
if (info.getUser().getId() == mUserId) // do stuff
}
.......
};
Also as @doncung explained to me that the box application was using your Sdk, i installed it. I configured three accounts about ten hours ago ... for the moment I did not have to redo a login , unlike my case??? After how long does the security logout occur with the default refreshtime? |
|
Looks like it should work. The SDK handles refreshing automatically so as long as you don't explicitly call logout or get an event that would trigger an invalid refresh the users should remain logged in. |
|
@doncung activity.mBoxSession = new BoxSession(getActivity(),mBoxUserId);
activity.mBoxSession.setSessionAuthListener(listener);
activity.mBoxSession.refresh().addOnCompletedListener(new BoxFutureTask.OnCompletedListener<BoxSession>() {
@Override
public void onCompleted(BoxResponse<BoxSession> response) {
if (response.isSuccess()){
// do my stuff
}else {
//do my stuff
}
}); It works but the response.issucces() return false.... |
|
We will try to improve our documentation for this use case. Also when you say after a while, what do you mean? the OnCompletedListener added to the refresh is specific to that forced refresh() call. The listener added to the session on the other hand should be getting called as long as that session is still in memory. You can also register a listener on BoxAuthentication.getInstance() which should get a call as long as your listener is in memory. |
|
@doncung |
PreciselyAlyss
added
documentation
Hello,
My application uses multiple cloud providers and for each provider uses multiple accounts.
Once I create an account I store the accessToken and the refreshtoken etc ... in database.
Then when I want to reconnect or change account here is how I proceed:
But that does not prevent sometimes that the view of login appears ???
The text was updated successfully, but these errors were encountered: