OAuth login from NEPacketTunnelProvider

How can NEPacketTunnelProvider launch the companion application, or notify user to launch the application?

I have built an iOS VPN that uses credentials stored in the keychain, and it works as expected. Now I'm trying to add OAuth login support.

Everything works fine at first. I login from the companion application, store tokens in the keychain, then launch the VPN from either System Settings or the companion application.

However, when the OAuth refresh tokens expire, or the OAuth IdP otherwise requires login, I can't perform the OAuth login from the NEPacketTunnelProvider. Login must happen from the companion application, which likely isn't running. I need the NEPacketTunnelProvider to either launch the companion application directly or to notify the user to do so.

Searching and reading docs yields:

1. You can't perform OAuth login from within the NEPacketTunnelProvider because it requires user interaction
2. There is no way to guarantee that the companion application is running on iOS (otherwise one would use NEVPNStatusDidChange)
3. You can't launch the companion application from NEPacketTunnelProvider using a custom URL because of security concerns
4. You might be able to launch the companion application from a system extension...
5. Some sources say you still can't guarantee that the system extension is loaded whenever the NEPacketTunnelProvider needs it anyway.

Of course, any of these conclusions could be wrong.

At this point I'm not sure where to begin. Is there another approach that could be initiated by the NEPacketTunnelProvider (push notifications, system notifications, smoke signals)?

Any help would be appreciated.

Thanks,

Bill Welch