OAuth Token getting Revoked On Spartacus - saml

Question

We have written a custom approach of Integrating SAML login flow with Hybris and Spartacus with the sequence as follows.
Sequence flow :
User gets redirected to IDP (OKTA) since there is no auth
session
User will login on the IDP login page and then the
request gets redirected to Hybris along with SAML assertions
On Hybris end, Hybris will validate these assertions and and will
generate a "Login Token" (Authentication Code) and will redirect to
Spartacus
On Spartacus end, it will Identify if there is a
"LoginToken" and if it exists spartacus will send this LoginToken to
Hybris and Hybris will return the access_token which will then be
set in localStorage of browser.
We have written a customer controller that will take the LoginToken as a parameter and will return the access_token in the response. We have used the below code in Spartacus to implement this and set the access_token in the localStorage on the browser. But the issue is spartacus is sending a token revocation request to Hybris on accessing any of the Spartacus pages and the access_token is being emptied.
**
What is the correct way of setting the access_token in spartacus if we are using a custom controller to generate OAuth ?
Or is there a different approach we should take in generating and persisting the access_token in Spartacus ?**
Code Snippet :
ngOnInit() {
var LoginToken = this.cookies.get('LoginToken');
var authToken= JSON.parse(localStorage.getItem('spartacus⚿⚿auth')).token.access_token;
var mainToken= JSON.parse(localStorage.getItem('spartacus⚿⚿auth'));
console.log('token value '+authToken);
if(!authToken && !LoginToken) {
console.log("Make call to Hybris for OAuth token");
let fetchUrl ='https://localhost:9002/occ/v2/{baseSite}/ssoauthenticate/?client_id=mobile_android';
this.http.post<any>(fetchUrl,"",{withCredentials:true,headers:{"Access-Control-Allow-Origin":"*"}}).subscribe(data => {
console.log(data.value);
mainToken.token.access_token=data.value;
mainToken.token.granted_scopes=data.scope;
mainToken.token.token_type=data.tokenType;
mainToken.token.expires_at=1631632676508;
mainToken.userId="current";
localStorage.setItem('spartacus⚿⚿auth',JSON.stringify(mainToken));
});
}
if(!authToken && LoginToken) {
console.log("Redirect for SSO");
window.location.href="https://localhost:9002/samlsinglesignon/saml/sso/";
}

Answer 1

There is an existing integration module for SAP Customer Data Cloud that implements this pattern (1905 Cloud Extension Pack: https://help.sap.com/viewer/bad9b0b66bac476f8a4a5c4a08e4ab6b/v1905/en-US/4658aaba5ff242ab99f2f89aa1a51ec8.html, 2005 onwards it is in the Integration Extension Pack: https://help.sap.com/viewer/b6a1e8b75222421a8faf0269e8fbd0dc/2102/en-US/f9df5c14bfdf47349dc9b82de84a574f.html)
However what the documents don't really say is: to enable this, there was a change to the OAuth capability to support CustomTokenGranter implementations. The SAP CDC integration then builds on that to provide CDC-specific logic in this area.
You need an OAuth token to access OCC APIs, and that needs to be issued from the SAP Commerce OAuth features. However in the CDC case the login is via automatically generated screensets that all work at the browser level. Broadly: the CDC login process is between the screensets in the browser + the CDC servers, the wrapper components in Spartacus take the output (call it login token if you like) and passes that into the OAuth token request. The CustomTokenGranter implemented in the CDC integration will then verify that token at the backend, so that OAuth can issue the a valid auth token back to Spartacus. Spartacus then uses that token in any OCC API calls, in just the same way that it handles a standard auth token.
There are analogies here to your process with Okta & you could do something similar (in terms of process). In these scenarios you really should have backend integration to your IdP as well ... to validate the tokens server-side & prevent spoofing.
The Spartacus side of this integration is open source, as with the rest of the Spartacus project. You can find the code here: https://github.com/SAP/spartacus/tree/develop/integration-libs/cdc