Class: RemoteAuthenticationFlow

This method is used to get Authorization headers and any custom headers to be set for making XHR requests to secured end points. Headers are returned as an object in a format that can be directly added to the XHR request headers.

authFlow.getHeaders().then(function(headers){
  var request; // Represents an XHR request
  ...
  for (var key in headers) {
    if (headers.hasOwnProperty(key)) {
      request.setRequestHeader(key, headers[key]);
    }
  }
  ...
}

This method is used to find out if the user is authenticated.

This method is used to login.

The promise is resolved when login succeeds. Once login is successful, if this authentication is for accessing the app, user can be allowed to do so. If it is to access data secured resources this operation can now be performed. It may also be required to obtain certain headers for accessing the secured resource. In this case RemoteAuthenticationFlow#getHeaders can be used.

The promise gets rejected with an AuthError object which contains information on the reason of failure. This information can be used to shown the reason why login did not succeed. App can keep track of these failures and implement specific policies related to maximum attempts and steps to do after multiple failures here.

Sample usage:

cordova.plugins.IdmAuthFlows.init(authProps).then(
  function(authenticationFlow) {
    var loginPromise = authenticationFlow.login();
    loginPromise.then(...);
    loginPromise.catch(...);
  }
);

This method is used to logout.

Once the promise is resolved, the user can be shown the login page to re-login or a way to attempt for the same. AuthenticationFlow#login can be invoked on the same AuthenticationFlow object. There is no need to create a new one, unless there is some change in the authentication properties such as server details.

User is essentially logged out even if logout promise is rejected. App can decide not to show the logout error to the end user as there is no action associated with it. There is one special case when device is offline. In this case, logout will throw an error because logout URL loading will fail. But device local logout will be successful. Application should handle this error, check for the device status (offline / online) and then decide to show the error message to the user.

The following table describes what is cleared on logout with different values for purgeSettings:

purgeSettings	false	true
HttpBasicAuthentication	Clear remembered credentials	Clears offline, remembered credentials, user preferences
FederatedAuthentication	Clear Cookies by loading logout URL
OAuth, OpenID	Clear access token	Invalidate session maintained by the browser by loading logout URL.

Option object to be used with RemoteAuthenticationFlow#getHeaders