How to enforce session timeout in Native-iOS App

Question

I am using SF Mobile SDK version 5.2. I am only using the sdk for authentication and authorization of SF users of our organization. Once a user is authenticated from the salesforce, he can use the app.

The problem I am facing is that SF Mobile SDK caches the user session and account details and after the first time use, always shows that the user has a valid session and validates the user and provides its details. Even when I disable or freeze the user from the salesforce admin, it keep authenticating the user in the app and the change only takes effect when user logs out and then try to login again.

This is how I am authenticating the user:

if SFAuthenticationManager.shared().haveValidSession {
    if let sfUser = SFUserAccountManager.sharedInstance().currentUser {
        // Session is valid and sfUser is retrieved
        // allow the user to use the app
    }
    else {
        // user not present
        // show the sf login screen
    }
}
else { 
    // no valid session present
    // show the sf login screen
}

I also revoked the session for a particular user in the 'Connected App OAuth Usage' section but of no use.

I want my cached session to expire (even after some time) so that my new changes can take affect and disabled or freezed users can be restricted from using the app.

Answer 1

I solved it by trial and error and by looking through the core sdk apis. Here are my findings:

1. After first time successful login, SFMobileSDK caches the user session and user account.
2. There is no expiration limit mentioned in the SDK for that session. Neither there is any option to set one.
3. Any changes done at the SalesForce admin end, won't take effect. You can disable/freeze the user, change its name, dept, etc. But nothing is reflected.
4. Even revoking the OAuth session token won't do any good.

So this is the bad approach to look for the session and fetch the user. Or in fact, this is incomplete implementation. What I was missing here is to refresh the user credentials before logging him in. Here is code:

    // Check for valid session from SFAuthenticationManager
    if SFAuthenticationManager.shared().haveValidSession {
        // Retrieve the current user from SFUserAccountManager
        if let sfUser = SFUserAccountManager.sharedInstance().currentUser {
            // Refresh the user credentials
            // If the session has expired, revoked or the user has been disabled, freezed
            // or restricted from using the app, error is thrown
            // otherwise success completion handler is executed providing auth info
            // and updated user account object
            SFAuthenticationManager.shared().refreshCredentials(sfUser.credentials, completion: { (authInfo, sfUserAccount) in
                // refresh successful, session is valid
                // and user account is updated
            }) { (authInfo, error) in
                print("Error: \(error.localizedDescription)")
            }
        }
    }

Simple enough, but it took me a considerable time before I could find it due to lack of documentation. It's such a basic flow that is required to do a successful authentication, but it was nowhere to be mentioned clearly.