I am learning about OAuth2 and reading about the four different grant types, but I am having a hard time seeing how you could use one of these flows for a first-party mobile native application where you don't want to open the native browser.
Out of the grant types:
Implicit grant - isn't practical since you can't get a refresh token, and you have no way to ensure that only your application or authorized clients can gain an access token.
Resource owner password flow - you can't ensure that only your application or authorized clients can gain an access token.
Client credentials grant - not relevant for this use case.
This leaves the authorization code grant. You can't use a client secret however, so you must leave it out.
This makes this flow similar to the implicit flow, but now the authorization server can use the redirect URI whitelist for some type of client identity verification, and the app gets refresh tokens.
It looks like you can register URI schemes with the mobile OS that can be used as the redirect URI to open you app on the authentication redirect. The problem with this is a illegitimate app can spoof responding to your applications URL scheme.
It seems adding PKCE would ensure that only the application that started the flow can use the authorization code returned from the authorization server. I'm not sure how this is different from using a state token passed to the authorization endpoint though.
These seems to rely on trusting that the user would start their login flow only from the right app?
You can also now use universal links for redirect URIs to ensure only your application can handle the redirects. Does this eliminate the need for PKCE?
Even with these schemes, you have to go through an external user-agent on the device to complete the auth flow.
Most major first party apps from Facebook, Twitter, Instagram and Google do not use the browser to log you in. You enter your credentials directly within their application.
This RFC states that a native app should use an external user-agent (a browser) to go through the authentication flow.
This makes sense to me, since a mobile native app shouldn't be considered able to store a client secret.
Then how do these major apps ensure a login flow where only your first party application can have an embedded login and everyone else must use an OAuth flow?