Remote authentication in SharePoint Online for Windows Phone apps

Remote authentication for SharePoint Online in native Windows apps is nothing new. Simply download the Remote Authentication in SharePoint Online sample from MSDN and paste the code into our own solution and you're pretty much ready to start firing REST calls at your SharePoint environment. However, for native Windows Phone apps, such libraries are not available. The sample from MSDN cannot be used in a Windows Phone app, since it references Windows.Forms which is not supported on the Windows Phone platform. Rewriting the sample code for use in a Windows Phone app turned out to be rather straight forward. First, I added a new Page to the app and placed a WebView component on it. Next, I copied a few methods from the ClaimsAuth namespace in the sample code and modified them a little to fit my needs better. Finally, I added a call to GetClaimsParams to my page initialization, wired a navigation event to my webview to process the results and started the flow by directing the WebView to the portal login url.

How it works

GetClaimsParams retrieves the login page url of the portal and the url of the page to which the browser will be redirected after authentication by making a HttpWebRequest to the portal url provided and parsing the request headers. The WebView is then  directed to this login page, where the user can provide credentials directly to SharePoint. Credentials are never passed to or stored in the Windows Phone app. Finally, the event handler firing after the WebView is navigates to a new page, checks if the current page is the page displayed after login, extracts the authentication cookies from it and navigates the app to MainPage of the app. The extracted cookies can now simply be added to the REST calls fired at SharePoint as per usual.

// Adds this to your page initializaton to set up cookie collection from WebView. 
// The actual collection and handling is handled in AuthenticationWebView_NavigationCompleted
await GetClaimParams(StartUrl);
AuthenticationWebView.Navigate(new Uri(LoginUrl));
AuthenticationWebView.NavigationCompleted += AuthenticationWebView_NavigationCompleted;

private async Task GetClaimParams(string targetUrl)
{
 HttpWebRequest webRequest = (HttpWebRequest)WebRequest.Create(targetUrl);
 webRequest.Method = "OPTIONS";

 try
 {
  WebResponse response = await webRequest.GetResponseAsync();
  ExtraHeadersFromResponse(response);
 }
 catch (WebException webEx)
 {
  ExtraHeadersFromResponse(webEx.Response);
 }
}

private bool ExtraHeadersFromResponse(WebResponse response)
{
 LoginUrl = null;
 EndUrl = null;

 try
 {
  EndUrl = new Uri(response.Headers["X-Forms_Based_Auth_Return_Url"]);
  LoginUrl = (response.Headers["X-FORMS_BASED_AUTH_REQUIRED"]);
  return true;
 }
 catch
 {
  return false;
 }
}

private CookieContainer ExtractAuthCookiesFromUrl(string url)
{
 Uri uriBase = new Uri(url);
 Uri uri = new Uri(uriBase, "/");

 // call WinInet.dll to get cookie.
 string stringCookie = CookieReader.GetCookie(uri.ToString());
 if (string.IsNullOrEmpty(stringCookie)) return null;
 stringCookie = stringCookie.Replace("; ", ",").Replace(";", ",");
 
 // use CookieContainer to parse the string cookie to CookieCollection
 CookieContainer cookieContainer = new CookieContainer();
 cookieContainer.SetCookies(uri, stringCookie);
 return cookieContainer;
}

protected void AuthenticationWebView_NavigationCompleted(WebView sender, WebViewNavigationCompletedEventArgs args)
{
 // check whether the url is same as the navigationEndUrl.
 if (EndUrl != null && EndUrl.Equals(args.Uri))
 {
  cookies = ExtractAuthCookiesFromUrl(StartUrl);

  // pass the extracted cookies to the MainPage for later use
  var parameters = new Dictionary();
  parameters.Add("cookies", cookies);
  parameters.Add("uri", new Uri(StartUrl));

  Frame rootFrame = Window.Current.Content as Frame;
  rootFrame.Navigate(typeof(MainPage), parameters);
 }
}