feat: Store device secret in keychain

Author: jjlangholtz

index.js

@@ -61,6 +61,8 @@ export const createConfig = async({
   endSessionRedirectUri, 
   discoveryUri,
   scopes,
+  keychainService = 'Okta',
+  keychainAccessGroup = 'com.okta.mobile-sdk.shared',
   requireHardwareBackedKeyStore,
   androidChromeTabColor,
   httpConnectionTimeout,
@@ -110,6 +112,8 @@ export const createConfig = async({
       endSessionRedirectUri,
       discoveryUri,
       scopes,
+      keychainService,
+      keychainAccessGroup,
       userAgentTemplate,
       httpConnectionTimeout,
     );

ios/OktaSdkBridge/OktaSdkBridge.swift

@@ -52,6 +52,38 @@ extension OktaOidcStateManager: StateManagerProtocol {
 
 }
 
+// MARK: - DeviceSecretKeychain
+
+class DeviceSecretKeychain {
+    var service: String
+    var accessGroup: String
+
+    init(service: String, accessGroup: String) {
+        self.service = service
+        self.accessGroup = accessGroup
+    }
+
+    func save(_ tokens: [String: String]) {
+        let query: [String: Any] = [
+            (kSecClass as String): kSecClassGenericPassword,
+            (kSecAttrService as String): service,
+            (kSecAttrAccessGroup as String): self.accessGroup]
+        SecItemDelete(query as CFDictionary)
+
+        for (kind, value) in tokens {
+            let attributes: [String: Any] = [
+                (kSecClass as String): kSecClassGenericPassword,
+                (kSecAttrService as String): service,
+                (kSecAttrAccessGroup as String): self.accessGroup,
+                (kSecAttrAccount as String): "Okta-\(kind)",
+                (kSecValueData as String): value.data(using: .utf8)!
+            ]
+
+            SecItemAdd(attributes as CFDictionary, nil)
+        }
+    }
+}
+
 // MARK: - OktaSdkBridge
 
 @objc(OktaSdkBridge)
@@ -70,10 +102,11 @@ class OktaSdkBridge: RCTEventEmitter {
     }
 
     var oktaOidc: OktaOidcProtocol?
-    
+
     override var methodQueue: DispatchQueue { .main }
 
     private var requestTimeout: Int?
+    private var deviceSecretKeychain: DeviceSecretKeychain?
 
     func presentedViewController() -> UIViewController? {
         RCTPresentedViewController()
@@ -85,6 +118,8 @@ class OktaSdkBridge: RCTEventEmitter {
                       endSessionRedirectUri: String,
                       discoveryUri: String,
                       scopes: String,
+                      keychainService: String,
+                      keychainAccessGroup: String,
                       userAgentTemplate: String,
                       requestTimeout: Int,
                       promiseResolver: RCTPromiseResolveBlock,
@@ -105,6 +140,7 @@ class OktaSdkBridge: RCTEventEmitter {
 
             oktaOidc = try OktaOidc(configuration: config)
             self.requestTimeout = requestTimeout
+            self.deviceSecretKeychain = DeviceSecretKeychain(service: keychainService, accessGroup: keychainAccessGroup)
 
             promiseResolver(true)
         } catch let error {
@@ -311,6 +347,15 @@ class OktaSdkBridge: RCTEventEmitter {
             }
 
             currStateManager.writeToSecureStorage()
+
+            // Only use the DeviceSecretKeychain if the response includes a "device_secret" field
+            if let deviceSecret = currStateManager.authState.lastTokenResponse!.additionalParameters!["device_secret"] as? String {
+                self.deviceSecretKeychain!.save([
+                    "id_token": currStateManager.idToken!,
+                    "device_secret": deviceSecret
+                ])
+            }
+
             let dic = [
                 OktaSdkConstant.RESOLVE_TYPE_KEY: OktaSdkConstant.AUTHORIZED,
                 OktaSdkConstant.ACCESS_TOKEN_KEY: stateManager?.accessToken

ios/OktaSdkBridge/ReactNativeOktaSdkBridge.m

@@ -21,6 +21,8 @@ @interface RCT_EXTERN_MODULE(OktaSdkBridge, RCTEventEmitter)
   endSessionRedirectUri:(NSString *)endSessionRedirectUri 
   discoveryUri:(NSString *)discoveryUri 
   scopes:(NSString *)scopes 
+  keychainService:(NSString *)keychainService
+  keychainAccessGroup:(NSString *)keychainAccessGroup
   userAgentTemplate:(NSString *)userAgentTemplate
   requestTimeout:(NSInteger)requestTimeout
   promiseResolver:(RCTPromiseResolveBlock *)promiseResolver