We have a Customer Community with Facebook and Google set up as Auth Providers. In addition, we have a mobile app that connects to Salesforce using OAuth towards this community.
This all works fine. Users can login with either username/password or social and get redirected towards the mobile app when they start the OAuth flow from the app.
We were thinking of using the links that get generated when you click on the Auth Provider buttons directly from the mobile app. The Auth Provider page also provides these urls, for internal login and for each community:
If we put the Single Sign-on Initialization URL into a browser, it redirects to Facebook in this case, we login to Facebook, it redirects to the External Identity and we're logged in.
This is basically the same that happens when we open this link from the mobile app. But what we would like to happen, is that instead of redirecting to the homepage of the community, it completes an OAuth flow and gives an access token to the app.
Is there a way we can retrieve the access token from this process?
I've seen that at a certain point in the process between Facebook and the community, it requests frontdoor.jsp and as a query parameter passes a Session Id. I've tried using this as a Bearer token in an API call to no avail.