Mobile app authentication by using Hybrid Access Gateway

Traditionally authentication in mobile apps is not much different from authentication in web applications. However there are some key differences in mobile apps

• The UI is not build up on the server side so any changes to the UI (e.g. new authentication methods) requires new version of the application to be deployed. These kinds of things take time and focus from the actual app development.

• For web application we have used federation (SAML) for years to handoff authentication to another server so that our web application can focus on its main responsibilities. Mobile apps have a hard time to integrate with these flows (Redirect and Post bindings).

• There is also the difference that when using mobile apps the user does not expect to login every time that he opens the app, since it is his device he expects to always be logged in but maybe not with full access, e.g. he might expect read access but want to get prompted for authentication for sensitive operations such as transfer money.

Figure 1: Classic mobile application scenario

Key points when developing a mobile application is that

• You want to be able to use the same user base and same password as for your web users there should not be a need to learn new passwords or new authentication methods i.e. authentication in mobile apps must go in line with current authentication.

• You want to have long lived sessions but with limited access, this is solved in OAuth2 with scopes

• You want to move the authentication flows away from the app so that new authentication methods do not require changes in the application and so that you can use federated authentication such as SAML.

• You do not want your application to store the users password locally neither to send it in HTTP basic header.

• You want to be able turn of access for a certain app without impact on other connected apps or be forced to change your credentials

• You want to enable multifactor authentication without struggling with all authentication flows in your app.

• You want to give the mobile app delegated access and not full access to your user account, i.e. provide limited access.

• You don’t want to distribute you credentials and store them in mobile apps

Hybrid Access Gateway can solve those issues in several different ways

Putting the API powering the application behind (proxy solution) the Hybrid Access Gateway can solve all these problems.

Figure 2: 1. The user is directed to the Access Gateway that will manage authentication and access control. 2. Userauthenticates and approves app to access API with requested scope. 3. User is directed back with a token. 4. App uses the token to access the API

Figure 3: Much responsibilities handed over to the Access Gateway

Then if one prefers not to proxy the application but still handover the authentication and authorization challenges to the access gateway we support token introspection.

Figure 4: Using introspection to separate API and Access Gateway

Finally the Access Gateway can do this for a whole set of applications and API providing a single point of audit.

Figure 5: Managing authentication and authorization for multiple apps with the Access Gateway