I have implemented my own identity provider (IdP) and am trying to achieve single sign-on (SSO) on Android, and by that I mean I am developing 2 different Android apps that use the same IdP to get authenticated and letting the user sign in on one of the apps which will allow him to get automatically signed in on the other.
In both my apps, I am using chrome custom tabs and, again to my understanding and correct me if I'm wrong, I did some research and found out that all custom tabs share the same cookies.
My IdP is now detecting the same session ID from the custom tab cookies and automatically logging in the user from app#2 if they have signed in successfully in app#1. the IdP is not cleaning any session data.
The problem is that this behavior is only lasting about 20 minutes or so. In other words, logging in app#1 will allow the user to get automatically logged app#2 only if they attempt login from app#2 within 20 minutes of logging in app#1. Otherwise, if they wait more than that, they will be asked for their credentials again.
I'm trying to understand what's happening here and I'm failing to identify the problem.
Could it be that custom tabs on Android don't retain their cookies forever, and only for 20 minutes? which means I should probably get that session ID myself and store it somewhere on the device (probably in the Android account manager) and use it for subsequent requests. The problem is that there is no way to access the custom tab cookies that I know of...
Any help, suggestions, comments would be appreciated. Thanks.