SG FAPI Connect Mobile – Singpass & Corppass - Overview (O11)

version 1.0.0 (Compatible with OutSystems 11)

Uploaded

on 29 Sep (15 hours ago)

0.0

(0 ratings)

Details

SG FAPI Connect Mobile adds Singpass and Corppass login to OutSystems 11 Mobile apps. It is a thin client library on top of the SG FAPI Connect web component, which does all FAPI 2.0 work on the server (PAR, DPoP, PKCE, private_key_jwt, encrypted ID token). No keys or tokens are stored on the device. The login runs in the phone's system browser (Custom Tabs / SFSafariViewController), and the app receives only a short-lived, single-use ticket through a deep link.

The app calls SGFapi_StartLogin. It creates a random secret on the device and sends only its SHA-256 hash to the server.
The server starts the FAPI 2.0 login (PAR) and the system browser opens the Singpass / Corppass page.
After login, Singpass / Corppass redirects to the SG FAPI Connect callback. The server exchanges the code, validates the ID token and creates a one-time ticket (valid 60 seconds, single use, only its hash is stored).
The server redirects to your app's deep link: AppReturnURL?ticket=… (or ?error=…&error_description=…).
Your callback screen calls SGFapi_CompleteLogin. It closes the browser and redeems the ticket together with the device secret. Only the device that started the login can complete it. The user is then logged in to OutSystems on the device.

Requirements

SG FAPI Connect (web component) installed and a login app configured in its admin console (Singpass or Corppass). See that component's documentation.
OutSystems 11 Mobile app, built with MABS (the login needs the native app – it does not work in the browser preview).
Plugins: Common Plugin and InAppBrowser Plugin (Forge, supported by OutSystems).

Release notes (1.0.0)

License (1.0.0)

BSD-3 license (https://opensource.org/licenses/BSD-3-Clause)

Reviews (0)

Team