Securing Electron Applications with OpenID Connect and OAuth 2.0

Hey there @bensmith.md!

As you can see above @dan-auth0 is constantly working on that!

@dan-auth0 It seems ok. Are you able to print out this console.log ?

if(url.includes(ā€œfile:///callback?codeā€)){
await authService.loadTokens(url);
console.log(here???);
return destroyAuthWin();
}

1 Like

Yup! It does print to the console but the home view doesnā€™t change :thinking:

Hi,

Thank you for this awesome article.
After some tweaks I got everything working like a charmā€¦in development.

Iā€™m using Electron Forge to build the app, which works fine on my machineā€¦ until I nuke the node_modules directory. After that when starting the app I get an error like : Cannot open /keytar/build/Release/keytar.node, 1:) image not found

I have tried a couple of options but I cannot seem to figure out how to resolve this.
I was wondering if you, or any one of you, might have a pointer in the right direction :slight_smile:

Thanks !
Gerard.

1 Like

Everyone, I want to share an update with you :slight_smile:

Weā€™ll need to research more on how to get Electron 7 to play well with the authentication flow and come up with updated guidance and best practices. This will take some time. At the moment, we may need to restrict the blog post to using Electron 5.

1 Like

Is this still in relation to the Google social login issue, Ben?

It does print it but the screen doesnā€™t change. It stays blank :thinking:

Correct, in seeing the error message intermittently using Google sign-in, but not with every account. Details here

1 Like

I am still working on getting you a proper and full explanation on this. Initial research has told me that this issue happens when you use Google authentication in non-standard browsers, such as the Electron runtime. It doesnā€™t happen to all Google accounts due to Google A/B tests or admin settings on Google accounts. A solution may be to open the systemā€™s browser to complete the login. I need to collect more information on how this can be done :+1:

Thank you for your time on this!

Hi,

We use Electron with Auth0 and Google integration and have been encountering this same issue. Some users will receive the following error when they try to login with google, whereas others (most users) are fine.
image

Unfortunately I havenā€™t been able to reproduce it on my own account in order to troubleshoot it, despite playing around with security settings etc in the gsuite admin. Does anyone know of a sure-fire way to get it to happen?

I notice a number of other tools like Slack/Postman seem to redirect to a login screen which opens in the default OS browser, rather than an embedded webview in the app itself. Maybe this is a better way to go, but what would the best way be to pass to tokens back to the app. You could have the app listen on a local port, and use a localhost callback perhaps, but maybe there is a better way.

1 Like

Howdy, Darren! Thank you for joining our community. I am collecting all this feedback and putting it together to present an identity story to our teams. We plan to get back to the drawing board and do some research and development on whatā€™s the best guidance that we can provide for Electron.

While this is at the top of my list, it is a process that takes time as weā€™d want to get things done correctly and have the guidance well-reviewed. I donā€™t have an ETA but I can definitely tell you that there is a Post-It note on my monitor that says ā€œELECTRON UPDATE!!!ā€ haha along with a story on my board to complete :+1:

Yā€™all are in good hands!

2 Likes

I can confirm that it happens consistently with my google account, but if I create a new gmail login I can log in no problems. I thought maybe it had something to do with 2 factor gmail auth, but turning this feature on for my newly generated gmail account doesnā€™t seem to affect anything.

Iā€™ve considered redirecting to the usersā€™ default browser to log in, using an Electron-generated key in the query string. The electron app would then ping the server every couple seconds. Once authenticated through auth0, save a hash of the key on the server and send user to page telling them to click on the Electron App that will then be logged in. On each Electron launch the key can be checked against the server-side hash to auto-login. Of course, password persistence could be handled different waysā€¦

Thanks for your diligence on this, @dan-auth0. So far Iā€™ve only had a handful of regular users whoā€™ve run into this issue, so itā€™s not widespread, but frequent enough that I need a solution to be sure. Iā€™m holding off on going with the key/hash plan above until I hear back. Being able to authenticate through auth0 in Electron is a smoother better UX IMO.

1 Like

Iā€™m seeing the same behavior. Thanks for keeping us up to date @dan-auth0

1 Like

You are welcome! Itā€™s definitely in the radar as a top priority. Itā€™s taking longer than usual because weā€™ve also been busier than usual :grimacing: We also want to ensure we provide you with a proper solution :+1:

You are welcome, Ben. Itā€™s still on the radar and the R&D is going on. Itā€™s taking some time because weā€™ve been busier than usual but this comes up on every meeting, I assure you of that! :sweat_smile:

I want to provide you an update on what we are doing as far as R&D goes for Electron:

Iā€™ve started a few internal feedback funnels to gather more information on use cases, pain points, implementation recommendations, etc.

Iā€™ve presented a few proposals on how to better relay information to our community on a technology like Electron that moves fast and breaks things :grimacing: One of my proposals is to provide you all with a well-documented sample app that follows our recommendations on implementation. A sample app is easier to maintain and iterate over than a blog post. What do you think about this approach?

I again want to thank you all for sharing your feedback on this thread, for choosing Auth0 as your Identity Solution, and for your valuable time :pray: Be assured that your voices and concerns are being heard! (or read)

:eyes: :ear::thinking: :microscope::woman_scientist: :man_technologist: :man_scientist: :woman_technologist:

1 Like

If itā€™s more maintainable and quicker to release, certainly a sample app that keeps up with Electron releases would be appreciated.

2 Likes

I am experiencing the same white screen after login issue in Electron 7 and 8. If I downgrade to Electron 6 the Auth0 login flow works as expected. Only trouble is I must use Electron 8. Thanks @dan-auth0 for working on this for us.

Weā€™re here for you @Mitchell!

Hi @dan-auth0,

cc @simone84, @jgisclair

Got it !!! Iā€™ve finally managed to get your tutorial app working in Electron 8.2.0 !

Your issue was the misuse of protocol.interceptWhateverProtocol(scheme, handler). Some explanations:

When using protocol.intercept***Protocol(scheme, handler), we are intercepting scheme protocol and uses handler as the protocolā€™s new handler which sends a new **** request as a response, as said in the doc here.

However, doing so totally breaks the initial handler for this specific protocol, which we would need after handling the authentication steps. Thus, we just need to restore it back to its initial state, so that it can continue working as normal :slight_smile: (this question helped me understand this point)

Solution:

Letā€™s use protocol.uninterceptProtocol(scheme) !

5 Likes