I am super new to the Hybrid architecture of Cordova Dev Tool and not very familiar with the architecture and the capabilities of it. I am working on building an app using Cordova that will allow only my company users (internal) to login and access it. Our users use the Cisco anyconnect VPN mobile client on mobile devices. I would like to authenticate that the user is connected to VPN when they login to my app. If VPN is not enabled, the app should error out with some sort of a message. Any ideas or sample code would be appreciated.
Thanks!!
Is there a resource that they can only access when using the VPN? I'd suggest that in your app you make a HTTP request to access that resource, if they're using the VPN it'll work but otherwise it won't work.
Related
I know this might be a very unusual question but I have been using IdentityServer 4 on .Net Core 2.1 for quite a while, serving all sorts of different APIs/Clients/Mobile Apps with connection to the internet at 'all times'.
Now I have encountered an interesting scenario where a User will have access to the internet and be able to authenticate with IdentityServer once but might not have access to internet after an X amount of time (X could be minutes/hours/days), but I still need to authenticate that user and login to use the 'offline features' of the app (even after closing the app).
I have thought about caching some credentials to then verify that the user is valid or using a system where I send an SMS code to then verify the user has the right phone (But that will only work if the app is on a mobile device, hence, not ideal). I'm still not set on any of the options.
I just wanted to ask if anyone else has encountered a similar problem like this, any suggestions would be appreciated. Please have in mind that the user may be logged out after using the app and still needs to be authenticated even if there is no internet connection. I like IdentityServer4 quite a lot, so I will prefer to keep it that way, and My App is developed using Xamarin Forms (iOS, Android, UWP), and the IdentityServer instance is on the cloud.
Thanks a lot for the help, any suggestion is appreciated.
Since only your service will know how to authenticate someone using their server-side credentials how about using the local secure platform features of the device (Secure Enclave, SafetyNet, whatever Windows does)?
The end result is that the user can use their already-configured PIN / fingerprint / faceprint to access your app, all backed by tamper-proof security hardware.
This also gives you the option to allow users to sign in only using their local credential by unlocking a previously stored refresh token. My banking app works like this for example - modern phones are really quite secure by default.
If you want to get fancy you could also enroll their device as a WebAuthn authenticator in your IdentityServer4 service and they could then use the same method to authenticate with the server when necessary.
Following situation:
An SAP OnPremise system is connected over cloud connector to SAP HCP
In the cloud version of the SAP mobile plattform (SMP) I configured the system
I have a hybrid app (using SAP Kapsel SDK) and try to connect to
a) SMP itself (registring)
b) also to the real backend sytem with the data needed
User name of SMP and backend system is not the same
Does anyone have a good tutorial / documentation link how to setup this correct?
I found a very good tutorial about the Kapsel plugins:
- https://blogs.sap.com/2016/10/20/getting-started-kapsel-part-1-sp13/
With a trial account and a trial backend account (same user name) it seems somehow working. But in my situation it is more complex.
Problem in other words (Edit)
I am searching for a way to use user & password from OnPremise system to authenticate against HCPms over a Hybrid app.
May I ask why you require two different users at all? From a usability point of view, it is very awkward for a user to give two sets of credentials for an app. I'd typically recommend to either
configure SCIM in Mobile Services. This would allow you to register with Mobile Services using your back-end credentials
configure no-auth in Mobile Services. While users still need to give their credentials for back-end access, they can register with Mobile Services without credentials at all
The rest depends on your back-end configuration. For example, if it requires Basic auth, configure your back-end connection accordingly and leave the user/password fields empty. When you supply those with your client requests, they will be forwarded to your back-end.
Edit: I misread the question and thought you were using "SAP Cloud Platform Mobile Service", the cloud equivalent of the SAP Mobile Platform. The answer basically remains the same, only the terminology changes (italic):
configure HTTP(s)-based Basic Authentication SSO in Mobile Platform. This would allow you to register with Mobile Platform using your back-end credentials.
configure no-auth in Mobile Platform. While users still need to give their credentials for back-end access, they can register with Mobile Platform without credentials at all
Either way, SCIM for Mobile Service is described in the documentation, and so is Basic authentication for Mobile Platform.
I am trying to make an app using Ionic in Mobile First.
The web application is has got both sso and WebIdentity(LDAP) for the login functionality....
How to approach for the Hybrid Mobile App?
I do not believe there is direct relation between using LDAP in IBM MobileFirst Platform and using SSO in IBM MobileFirst Platform.
SSO in MFP allows you to automatically login to app2 if you have already logged-in in app1.
So assuming your are able to login to app1 via LDAP (which is server-side anyway, to check your credentials against a list of users), and assuming you have correctly set-up both apps for SSO, it should work.
Read about setting up SSO: http://www.ibm.com/support/knowledgecenter/SSHS8R_7.1.0/com.ibm.worklight.dev.doc/devref/c_device_single_sign_on.html
I have an WinJS metro application that I'm using to connect to a remote webservice that same domain. I read up on the app manifest capability (well the little that is present online) and was hoping that I would be able to use the logged in users credentials to access this webservice without requiring them to login.
I'm trying to authenticate to the webservice via a post using a contentType: "application/x-www-form-urlencoded;charset='utf-8'". This application was previously a website that would prompt the user for login credentials in the authentication step using the aforementioned post. In the WinJS metro application I'm effectively using the same code (minor tweaks) to achieve the same result.
Has anyone had experience with Enterprise Authentication in a WinJS metro application and could better explain what types of resources I would/wouldn't have access to. I'm hoping this isn't specific to accessing things like file shares and intranet sites.
I had this exact issue as well. After ensuring the following Capabilities were enabled in the package.appxmanifest:
Enterprise Authentication
Internet (Client)
Private Networks (Client & Server)
I had to still add the URL of our web service to Internet Explorer's list of Intranet Sites. Only then did the prompt go away.
I'm currently planning a new web project. Clients are going to connect using a regular web browser and, in case of regular java-enabled cell phones, j2me client. I would really like to make use of the OpenID authentication. In case of regular web browser things are pretty straightforward. However, I am really not sure about installed applications (such as j2me client installed on a mobile device) - regular OpenID authentication is performed by entering username/password on a webpage of particular OpenID provider - which is quite a limitation :)
Has anyone coped with such a situation? Is it possible to create authentication mechanism to the site that uses OpenID from a mobile j2me client?
Currently, I think of solution that users who would like to connect from their mobiles download necessary j2me application from the server web site after they have authenticated themselves (regular browser authentication). The mobile client app could be assembled dynamically on the server with the SSL certificate embedded that is associated with particular logged in OpenID user. After that, j2me client could authenticate to the server without entering any username/password. The data that is going to be stored on the server is not THAT sensitive - considering cases of mobile phone thefts etc.
Can anybody come up with a better solution?
The best solution IMO for what you're doing is to use OAuth combined with OpenID. You're use of OpenID at the RP is fine. But for installed applications that need access to that web site, they should use OAuth to get authorized. The flow would work like this:
User installs app on their device
During install or on first launch, the app has an "Authorize me" button.
The user presses the button and a web browser pops up the web site that the client app needs to access data from.
User logs into that site using their OpenID
Site now asks "do you want to authorize client app X?"
User says yes and closes the browser.
The client app reappears and says "thanks." and now has the OAuth token necessary to access the user's data without the user ever logging in again.