How to integrate GTMOAuth2 with RestKit on iOS? - iphone

Question

I'm trying get RestKit (version 0.10.2) to authenticate with OAuth2. I'm using GTMOAuth2 to handle the OAuth interactions.
I've successfully gotten GTMOAuth2 to sign me in and make a request to the api I'm using.
I've also managed to get RestKit to make a request with my access token with this:
- (void)setRKAuthorizationToken:(NSString *)authorizationToken {
RKObjectManager* objectManager = [RKObjectManager sharedManager];
NSString* authHeader = [NSString stringWithFormat:#"Bearer %#", authorizationToken];
[objectManager.client setValue:authHeader forHTTPHeaderField:#"Authorization"];
}
In this code sample I am manually setting the HTTP header because RestKit's support for OAuth2 sets the header as Authorization: OAuth2 <accessToken> instead of Authorization: Bearer <accessToken>.
Anyway, this works great until the access token needs to be refreshed with the refresh token.
What I'd really like to do is tell RestKit to use GTMOAuth2Authentication's - (BOOL)authorizeRequest:(NSMutableURLRequest *)request; as it automatically fetches a new access token with the refresh token when the access token expires.
BTW, RestKit is phasing it's support for OAuth; authorizing requests with a third-party library is the suggested approach. I asked for an example and the response pointed me in the direction of classes to subclass, which are in the development branch.
So, the question is: Have you successfully integrated RestKit 0.10.x with GTMOAuth2 or know how to accomplish this?

Answer 1

I'm going to answer my own question here because I have something that works, but it's not ideal.
Basically I am continuing to sign requests manually, and to deal with the possibility of an expired token, I am using GTMOAuth to authorize a dummy request. The serious downside is that it means an extra request to the api. But, now I know I have a valid access token. Part of the trick is going to be knowing when to call loginWithBaseController:.
Here is the basic concept:
- (void)makeRequestToEnsureAccessTokenSuccess:(void (^)())block error:(void (^)(NSError*))errorBlock {
NSURL *url = [NSURL URLWithString:#"https://uri/to/a/basic/api/call.json"];
NSMutableURLRequest *request = [NSMutableURLRequest requestWithURL:url];
// TODO: Only do this if we need to. It's kind of a waste to refresh the token
// all the time.
[self.gtmoauth authorizeRequest:request completionHandler:^(NSError *error) {
if (error) {
errorBlock(error);
} else {
[GTMOAuth2ViewControllerTouch saveParamsToKeychainForName:kKeychainItemName accessibility:NULL authentication:self.gtmoauth];
block();
}
}];
}
- (void)loginWithBaseController:(UIViewController *)baseViewController {
[self loadAuthFromKeyChain];
if (self.gtmoauth.canAuthorize) {
[self makeRequestToEnsureAccessTokenSuccess:^{
NSLog(#"setting RKAuthorizationToken with %#", self.gtmoauth.accessToken);
[self setRKAuthorizationToken: self.gtmoauth.accessToken];
[self.delegate authorizationFinished];
} error:^(NSError* error) {
[self logout];
[self showAuthorizationControllerFor:baseViewController];
}];
} else {
[self showAuthorizationControllerFor:baseViewController];
}
}
Anyway, I am still looking for a better solution. I thought I would post this in case it helps someone else at least through development.

Answer 2

This post on the RestKit Wiki, OAuth Support on Restkit references a complete solution using AFOAuth2Client.
The referenced sample iOS application at telegraphy-interactive/OAuthClientSetup has a pluggable architecture for authorized operations. It includes a class, OACSAuthOpRK that provides a RestKit RKObjectManager operation for making an authorized request.
The strategy used there is to wrap the request inside of the authorization. The authorization checks the currency of the OAuth2 authorization token. Finding the token current, it tries the request and checks the return status. Finding the token expired, or finding a 401 status return from the request, it will refresh the authorization token and try the request one more time.