MICROSOFT_PRESS_EBOOK_PROGRAMMING_WINDOWS_8_APPS_WITH_HTML_CSS_AND_JAVASCRIPT_PDF

There is one subtle difference between the findAll and retrieve methods in the list above. The
retrieve method will provide you with fully populated credentials objects. The findAll methods, on the
other hand, will give you objects in which the password properties are still empty. This avoids
performing password decryption on what is potentially a large number of credentials. To populate that
property for any individual credential, call the PasswordCredential.retievePassword method.
For further demonstrations of the credential locker—the code is very straightfoward—refer to the
Credential locker sample. This shows variations for single user/single resource (Scenario 1), single
user/multiple resources (Scenario 2), multiple users/multiple resources (Scenario 3), and clearing out the
locker entirely (Scenario 4).
The Web Authentication Broker
Although apps can acquire and manage user credentials of their own, supplying users perhaps with the
ability to create app-specific or service-specific accounts (typically through the Settings charm, as
discussed in Chapter 8 and also on Guidelines and checklist for login controls), you might want to
simply leverage an account that the user has already created through another OAuth provider,
especially when you want to use that provider’s resources. You’ve likely experienced this on many
websites already, where you log in through another site like Facebook. Of course, that typically means
navigating away from the original website to the provider’s site—a process that flows well enough in a
web browser but isn’t quite so attractive in the context of an app!
For this purpose, Windows provides the Web Authentication Broker, which essentially does the same
job without leaving the context of the app itself. An app provides the URI of the authenticating page of
the external site (which must use the https:// URI scheme, otherwise you get an invalid parameter
error). The broker then creates a new web host process in its own app container, into which it loads the
indicated web page. The UI for that process is displayed as an overlay dialog on the app, as shown in
Figure 14-3, for which I’m using Scenario 1 of the Web authentication broker sample.
FIGURE 14-3 The Web authentication broker sample using a Facebook login page.
661