title: How to setup Identity Server 3 for IOS client using Authorization Code flow
body: <p>Lately I've bee playing around with Thinktecture's Identity Server 3 and more specifically clients and flows. Now I want to see how the communication happens between <strong>native IOS application</strong> and <strong>Identity Server 3</strong> using <strong>Authorization Code flow</strong>.</p>
  <p>What I've done so far is consuming the STS(Identity Server 3) by ASP.NET Mvc client(Hybrid flow) and AngularJS client(Implicit Flow). The STS side looks like this:</p>
  <p><strong>Implicit flow client setup on STS</strong>:</p>
  <pre><code>new Client 
              {
                  ClientId = &quot;implicitangularclient&quot;,
                  ClientName = &quot;Angular client (Implicit)&quot;,
                  Flow = Flows.Implicit, 
                  AllowAccessToAllScopes = true,
  
                  IdentityTokenLifetime = 10,
                  AccessTokenLifetime = 120,
                  // If we want to have SSO between Angular app and MVC app we need to have this option set to
                  // false for both the flows they implement(hybrid and implicit).
                  RequireConsent = false,
  
                  // redirect = URI of the Angular application
                  RedirectUris = new List&lt;string&gt;
                  {
                      &quot;https://localhost:44555/callback.html&quot;,
                      // for silent refresh
                      &quot;https://localhost:44555/silentrefreshframe.html&quot;
                  },
                  PostLogoutRedirectUris = new List&lt;string&gt;()
                  {
                      &quot;https://localhost:44555/index.html&quot;
                  }
              }
  </code></pre>
  <p><strong>Hybrid flow client setup on STS</strong>:</p>
  <pre><code>new Client 
              {
                  ClientId = &quot;hybridclient&quot;,
                  ClientName = &quot;Mvc client (Hybrid)&quot;,
                  Flow = Flows.Hybrid, 
                  AllowAccessToAllScopes = true,
                  // If we want to have SSO between Angular app and MVC app we need to have this option set to
                  // false for both the flows they implement(hybrid and implicit).
                  RequireConsent = false,
  
                  IdentityTokenLifetime = 10,
                  AccessTokenLifetime = 120,
  
                  // redirect = URI of the MVC application
                  RedirectUris = new List&lt;string&gt;
                  {
                      &quot;https://localhost:44556&quot;
                  },
                  
                  // Needed when requesting refresh tokens
                  ClientSecrets = new List&lt;Secret&gt;()
                  {
                      new Secret(&quot;hybridflowsecret&quot;.Sha256())
                  },
                  PostLogoutRedirectUris = new List&lt;string&gt;()
                  {
                      &quot;https://localhost:44556&quot;
                  }
              } 
  </code></pre>
  <p>Well, now my goal is to setup a client which is a native IOS application using the authorization code flow. I currently have no IOS application but I wish I could make a setup for such a client so if one day I have IOS app, I can only give it the client id, client name and client secret I have already defined and let it run. I tried to find examples on the internet but didn't have success with that so I started digging into it. What I am now wondering is what the return url should be and how does it get processed client-side. Following this specification: <a href="https://datatracker.ietf.org/doc/html/draft-ietf-oauth-native-apps-03#ref-iOS.URIScheme" rel="nofollow noreferrer">oauth2-native-apps-03</a>, starting from <a href="https://datatracker.ietf.org/doc/html/draft-ietf-oauth-native-apps-03#section-5" rel="nofollow noreferrer">section 5</a>. It says that</p>
  <blockquote>
  <p>There are three main approaches to redirection URIs for native apps:
  custom URI schemes, app-claimed HTTPS URI schemes, and loopback
  redirects.</p>
  </blockquote>
  <p>So far, so good, but as far as I understand, on the client side app we need to <strong>register custom URI scheme</strong> which I've never done before(I've never done ios development in general). Even more, we need to open the app after a specific URL(most likely, the ReturnUris url) is passed to the phone browser that launched the authorization process. I also spent some time on <a href="https://developer.apple.com/library/ios/documentation/iPhone/Conceptual/iPhoneOSProgrammingGuide/Inter-AppCommunication/Inter-AppCommunication.html" rel="nofollow noreferrer">Inter App communication for IOS</a> but didn't really get the answer of my question which is: <strong>If I want to abstract myself from the IOS application and its setup and I want to configure only the STS, how could I do that in terms of setting up the Client object for this case on STS level? What should be the redirect uri(As far as I understand it is kind of reverse DNS notation. Something like com.mycompany.apples)? Just imagine I am STS administrator and a physical client comes to me and says: <em>Hey, I have IOS application with this id, this secret and that return uri, please set it up for me on your STS.</em></strong></p>