Worklight Push notification in app without authentication - ibm-mobilefirst

I am trying to implement the push notification feature for a Worklight application.
In the Push docs it is stated that the app should use authentication, also the sample project contains a login form used in this purpose. The problem is that my app does not require any authentication and/or login. I have the PushAdapter successfully deployed, also the required client code but I cannot get the client registered in the WL's Push notification console.
Any hints will be appreciated.
Thanks

Authentication is required for Worklight Push. Your Push adapter is going to use userid to find the device to push to. This wouldn't make any sense if the mobile device didn't authenticate with some user id.

Related

Best Approach for Push Notifications for both IOS and Android

I am building the backend for our company's mobile app and we need to send notifications to users from API based on some events. I need some advice on how I can implement this. I am looking for a platform where I can send notifications for both IOS and Android. I recently came across Firebase and got some info that the mobile-app will send a device token to the server, then we will handle the push notification using this token. My assumption here is, I need to save this device token for all the users in a database and send the notification as necessary. Is this the best approach or are there any other good approaches for this? I am pretty sure there will a lot of solutions where I do not have to handle this myself (in database)
I was also looking into Azure Notification Hub for this, but the cons I felt here is that my UI guy (outsourced) is developing the application in React Native and I have not seen any good examples of React Native using Azure Notification Hub.
I am expecting around 1000 users for my application and I am developing my backend in ASP.NET WebAPI. Mostly I will have 2 types of notification
Push notification to specific user.
Push Notification regarding new installations to all the users
Well, according to my experience the best way and the easiest way is using firebase. You will have a lots of option there. In fact according to their comment, whether you're a beginner, intermediate or advanced React Native developer you can be up and running with React Native Firebase in no time.
https://www.npmjs.com/package/react-native-firebase
For more information and adding a project:
https://rnfirebase.io
Firebase getting start:
https://github.com/invertase/react-native-firebase-starter
How does it work?
Firebase Cloud Messaging architecture diagram
An FCM implementation includes two main components for sending and receiving:
A trusted environment such as Cloud Functions for Firebase or an app server on which to build, target, and send messages.
An iOS, Android, or web (JavaScript) client app that receives messages.
You can send messages via the Admin SDK or the HTTP and XMPP APIs. For testing or for sending marketing or engagement messages with powerful built-in targeting and analytics, you can also use the Notifications composer.
last comment copy-right: https://firebase.google.com/docs/cloud-messaging/

Google Cloud Messaging, registration handshake

I've been looking everywhere for an answer to this, it says it goes something like server > GCM > client, the client must register and then it sends the registration token back to the server, but the 'client' part im confused about, does this only work on applications on the device? or can the app be on a website too? so for example if my app is a website, can I have the registration process on a website instead of an actual app on the device?
Yes, the currently listed client apps are Chrome, Android and iOS. Fortunately, you can use Progressive Web Apps to handle push notifications to websites.
The usual prerequisites are listed there, such as creating the Google Developer Console project, and other PWA fundamental configurations (add, register, and install Service Workers). The succeeding steps are PWA-specific implementations for you to have push notification implemented on the web page.
Happy coding!

Does MobileFirst authentication framework provide any option to explicitly bypass the security check for specific resources?

I am using IBM MobileFirst platform 7 to develop a hybrid application for one of my clients. I am using the below environment setting to protect the app so that on app launch when it connects to the MobileFirst server, app will receive a security challenge from the server.
<iphone bundleId="com.AppTest" version="1.0" securityTest="mobileTests">
The app handles the challenge by showing the login screen to the user. I am using adapter based authentication for the app. This is working fine.
Problem with the above setup: There is a 'New user sign-up' link in the login screen that redirect the user to a sign-up screen. On load of the user sign-up screen, app is invoking an adapter procedure to get some data. The adapter procedure invoked from the sign-up screen is not protected with any security test.
Even though the adapter procedure is unprotected, the above setup doesn't allow the app to invoke the procedure before a successful user authentication. Server is throwing a challenge back to the app when the user clicks on the registration link and he stays on the login screen.
Does MobileFirst authentication framework provide any option to explicitly bypass the security check for specific resources while using environment level protection? I have gone through the platform documentation and couldn't find any such options. If anyone faced a similar problem and resolved it, could you share your suggestions on handling this please. Thanks.
The adapter procedure invoked from the sign-up screen is not
protected with any security test.
Does that mean that the specific procedure has no securityTest assigned to it? If so, you can try setting it as securityTest="wl_unprotected". Even if not explicitly setting a securityTest, there still default security assigned internally. To disable that try the mentioned wl_unprotected suggestion.
Read more here: Understanding predefined Worklight authentication realms and security tests
Setting securityTest value to wl_unprotected means that the resource
will not be protected by any of Worklight platform security
mechanisms. This security test cannot be used to protect application
environments and event sources as they both require user and device
identities. Usually this security test is used to protect adapter
procedures that should be publicly accessible without any
authentication requirements.

IBM Worklight - Keep me logged in feature

I am developing a mobile application using Worklight, in which when a user signs in after authentication he should not sign in again and again. Could you please tell me how to keep the user logged in?
Check out the 'Form based authentication in hybrid applications' project in the Getting Started page: http://www.ibm.com/developerworks/mobile/worklight/getting-started.html#GS_security
There is also another feature of Worklight called 'heartbeat' which keeps your session alive by sending a simple request to the server. This also happens automagically without need configuration. It can be configured see here for more information (http://pic.dhe.ibm.com/infocenter/wrklight/v6r1m0/index.jsp?topic=%2Fcom.ibm.worklight.installconfig.doc%2Fadmin%2Fc_optimizing_and_tuning_of_ibm_wl_server.html&resultof%3D%2522%2568%2565%2561%2572%2574%2562%2565%2561%2574%2522%2520).
Can you give more context to your question so the community can help figure out the problem? What version of Worklight are you using?

Cannot register in sample BlackBerry push application

I am developing a BlackBerry application in which I need to use PUSH API. I already have registered with RIM and they have sent me the credentials for evaluation service. In my BlackBerry device, I installed sample push API application just to test that the push messaging works. After setting the content provider URL which is publicly accessible, I entered all the details for the sample application to register the it for receiving notification messages. When trying to register it asks for username and password but I don't know what they are for. In the email received from RIM, there are passwords for server application and content provider admin portal applications but not for the push client.
When I added an arbitrary username and password it fails with the message that java.lang.Exception Registration with Push API failed, caused by port is unavailable. But when I unregister it successfully unregisters the user with the given arbitrary username and password. By the I use the port given in the RIM's email.
I have no idea why this happens and I appreciate immediate response from you. Thank you.
The first thing to point out is that the RIM sample push application is ridiculously overcomplicated. The username and password you are referring to are used to authenticate against the sample push initiator web application which runs on your tomcat server. It doesn't matter what you put in there, they are not used for authentication. I can only assume they were added to show you that you can send a username and password to a web based service.
The only things you need in your BlackBerry app to register for the push service are:
Push Application ID (e.g. 2672-c870l6c924r1i298O4o33cc5391y0e75134)
Push Port (e.g. 31940)
BlackBerry Push Server URL (e.g. http://pushapi.eval.blackberry.com)
The port is unavailable message you're receiving is probably because the device you're using has not been provisioned for BlackBerry Internet Services (BIS). Make sure it has a SIM with an active BlackBerry data plan.