Redirect in Chrome Custom tab is not captured for deep link

Question

I'd like to capture a redirect that occurs in a Chrome Custom tab to ensure the user stays in a native mobile application.

Here's how the Chrome Custom Tab is launched:

val url = "https://demo.company.com/sso/oidc/start/?idp_connection_id=Username-Password-Authentication&status_response_url=https://member.example.com/urgent"
val builder = CustomTabsIntent.Builder()                                                                                                                                         
val customTabsIntent = builder.build()                                                                                                                                           
customTabsIntent.launchUrl(this, Uri.parse(url))

That web page redirects to the URL given as the status_response_url parameter after the user authenticates. The mobile app registers for the appropriate scheme:

 <intent-filter android:autoVerify="true">
     <action android:name="android.intent.action.VIEW" />
     <category android:name="android.intent.category.DEFAULT" />
     <category android:name="android.intent.category.BROWSABLE" />
     <data
         android:host="member.example.com"
         android:scheme="https" />
  </intent-filter>

Unfortunately, the system does not seem to capture the redirect. Why?

Answer 1

This is a well known problem with App Links and SSO, due to the lack of a user gesture.

You are using the preferred Claimed HTTPS Schemes option but an interstitial web page is needed for it to work reliably.

My blog post has further info on this, including a code sample you can run to review the UX.