iOS Today Widget utilize Uber login token

Question

I have an app with an Uber login that gives access to restricted API calls (info on the current ride). I'd like to share the login token with the associated Today Widget so it can make similar calls.

I'm already sharing data with a UserDefaults suite, and I'm using the UberRides SDK. In digging into the RidesClient object it seems to try to use the keychain for storing/sharing the login token, and I set up a shared keychain to try to take advantage of this, but no luck. Restricted API calls from the widget return as unauthorized. Any suggestions?

Here's some code from the widget (note the user already authenticated in the main app):

let rc = RidesClient()
rc.fetchCurrentRide { ride, response in
    if ride == nil { print("NO CURRENT RIDE") }
    print(response.response)
    print(response.error?.title)
    if let ride = ride {
       // do something
    } else {
        self.ride = nil
    }
}

This returns an unauthorized response. I traced into the RidesClient (which is an object in the UberRides SDK), and see the code where the token is "supposed" to come from the keychain, but it doesn't.

I also tried generating my own URL request in the widget, using the login token passed through shared UserDefaults. This followed the standard HTTP access approach, putting the token in the Authorization header. But I got the same unauthorized response.

Here's some more details on the SDK approach:

Main app uses the LoginButton in native mode:

    let scopes: [RidesScope] = [.Profile, .Places, .Request, .AllTrips]
    let loginManager = LoginManager(accessTokenIdentifier: Configuration.getDefaultAccessTokenIdentifier(), keychainAccessGroup: "com.MYCOMPANY.MYAPP.share", loginType: .native)
    let loginButton = LoginButton(frame: loginFrame, scopes: scopes, loginManager: loginManager)
    loginButton.presentingViewController = self
    loginButton.delegate = self
    view.addSubview(loginButton)

The login button does the right thing and authorizes in the Uber app. I can see the token returned in the delegate callback didCompleteLoginWithToken. However, I can then check for the token:

let token = TokenManager.fetchToken(Configuration.getDefaultAccessTokenIdentifier(), accessGroup: "com.MYCOMPANY.MYAPP.share")
print(token)

The token is "nil". I don't think the SDK is saving the token into the access group keychain.

When I use the default keychain (not the keychainAccessGroup), the login in the app works fine and I can get the login token back and make restricted calls to the API. However, that doesn't help the widget, which needs the token from the access group keychain.

Answer 1

Solved!! After many hours of debugging, and searching. What was not clear in ANY documentation is the keychainAccessGroup MUST include the AppIndentifierPrefix. That's the 10 character identifier associated with the App ID. So, instead of using "com.MYCOMPANY.MYAPP.share", it's "APPID.com.MYCOMPANY.MYAPP.share" for the keychainAccessGroup.