We use the Auth0 Swift GitHub - auth0/Auth0.swift: Auth0 SDK for Apple platforms for iOS and Auth0 Android GitHub - auth0/Auth0.Android: Android toolkit for Auth0 API native SDKs. Currently, logging in/authentication works using an in-app web browser. Is it possible to launch the native mobile Facebook app (or native Twitter app, etc.) to authenticate/log in? (I’ve seen other apps do this. They log in using Facebook, and once completed, the original app in is relaunched.) I looked through the documentation and it seems it used to be possible using Lock iOS v1 and Lock Android, but no longer. Is this indeed correct? Will this feature be added back? And when?
We are having trouble with this too.
Using a webview completely negates the UX benefit of using FB login. If a user has to remember their FB email and password, then enter their username and password, they might as well have created a new email/password account instead.
And most users will need to enter their FB credentials into the webview login since most people use the FB app and most apps implementing FB login use the app not a webview.
It also looks untrustworthy. A typical user wouldn’t know if this is a legitimate FB login screen or a phishing attempt.
1 Like
We’re having the same problem. As partial solution we capture the call to window.open and open that in the native browser, e.g. Safari. At least this way if you’re logged into Facebook on Safari, you’ll be able to reuse that session. Having the choice to open it in the mobile native Facebook app would be better though.
Yes I saw that question. But the reason why I asked my question is because the other question is regarding React-Native and not the native iOS and Android SDKs. So my question not technically a duplicate.
I have the same situation. Currently considering a switch from IDServer. I start by launching a native facebook login, then passing the users token to the idserver. I guess this can be made the same with Auth0 either using the SDK or the Rest API. Not sure if they both support it. This way you can very simple get the behavior you are looking for.
There have been discussions around this implementation, but at the moment it is not supported. While the solution that uses the facebook native app carries a better UX, we are currently following the recommendations of the Internet Engineering Task Force (IETF), who has recently release a Best Current Practices (BCP) when using OAuth 2.0 with native mobile applications where it states that OAuth 2.0 authorization requests from native apps should only be made through external user-agents, primarily the user's browser..
You can read more about this recommendation here:
OAuth 2.0 Best Practices for Native Apps
https://www.rfc-editor.org/rfc/rfc8252.txt
Mobile Device Login Flow Best Practices
1 Like
Thanks for the detailed explanation.
I skimmed through the RFP and read section 5 “Using Inter-App URI Communication for OAuth.” So it’s definitely possible to support the native flow (using external user-agents) sans browser. (“Primarily” doesn’t mean “exclusively.”) So please put my vote in for this feature request! 
4 Likes
We also are in desperate need for this feature from a UX perspective point of view. As @anthony.manning.fran already pointed out, the FB Login flow looses lots of its benefits when FB login has to be used this way.
Is there any way to achieve a flow including the native FB app using Lock 11 or a custom login solution using auth.js? (of course, a solution using the present Lock 11 would be very much appreciated)
1 Like
@ricardo.batista: As @chrisjf investigated, a UX friendlier flow should not violate the RFC anyways. Could you please reconsider to implement this feature?
Desperate for this feature too. Just implemented Auth0 and I’m surprised this isn’t already in place. Using webview seems fairly pointless if users are required to enter email address and password - it’s nearly as quick to register with a email/password account.
Any more information on this feature?
1 Like
We have used Auth0 for quite some time now, and we also feels this is a major UX disadvantage. As much as we love Auth0 we are considering other authentication providers because of this.
It would be great to hear if Auth0 is reconsidering this solution?
2 Likes
I think it would relieve our pain if Auth0 would step back from deprecating the grant_type “http://auth0.com/oauth/legacy/grant-type/access_token”. Because then, to my point of view, it should be possible to use the Facebook SDK to login the user, and then to use the FB auth_token to authenticate the user towards Auth0.
At the risk of sounding repetitive: this is a really big thing for us too. We want our users to experience as little friction as possible when logging into our mobile apps and right now the whole experience is just frustrating to them (and therefore to us).
We absolutely love what Auth0 has done for us in terms of security, stability and user satisfaction, so fingers crossed y’all will fix this one.
2 Likes
Thanks for explaining all of that @ricardo.batista – has there been an update on this functionality for either the native or react-native implementation? Thank you! We desperately need this feature as well, not just for Facebook but also for Google. Thanks again.
1 Like
Any updates on this issue? We need it too.
Hi Folks! @eoa.dev @saramusx @c.kapplmueller @bailey.dave @rasmus @jasper.kuperus @anthony.manning.fran @chrisjf @kenhaa
We just opened a public beta for Native login with facebook. We would love to hear your feedback, take a look:
http://community.auth0.com/t/announcing-native-login-with-facebook-public-beta/40665