Authentication through REST API

[DrumScorps]

It appears the current REST API does not provide the ability to authenticate users (via HTTP auth or similar). I've found an OAuth plugin (https://github.com/wohali/ips4-oauth2-server) but would prefer to provide a more native authentication experience into my app. I have an iOS and Android app and would ultimately like to be able to authenticate a user without going through OAuth. Are there any recommended approaches to this? Or am I stuck trying to replicate the sequence of HTTP requests in order to mimic the OAuth workflow?

[Stuart Silvester]

This isn't something that's integrated into Invision Community, but you may be able to use this 3rd party addon: 

 

[DrumScorps]

13 minutes ago, Stuart Silvester said:

This isn't something that's integrated into Invision Community, but you may be able to use this 3rd party addon: 

 

This is the approach I'm currently using. I would like to avoid having to launch a browser within my app for the OAuth login though. The login page has buttons/links that do not relate to loggin in that offer oppurtunities to veer off track. I'm hoping to add a native login page to my app where the user can enter their username and password without having to do so through a browser.

[Stuart Silvester]

7 minutes ago, DrumScorps said:

This is the approach I'm currently using. I would like to avoid having to launch a browser within my app for the OAuth login though. The login page has buttons/links that do not relate to loggin in that offer oppurtunities to veer off track. I'm hoping to add a native login page to my app where the user can enter their username and password without having to do so through a browser.

Oh, I see. I'm not aware of any existing applications/addons that would allow you to do this. You would need to write either a plugin or application to do this. You could for example, create a plugin that extends the core REST API to process user credentials.

[HeadStand]

It's important to note that if you do extend the core REST API for this, the remaining API calls will not take this into account. The API was designed to be admin-based, and does not make use of permissions.