Applying Identity to Secure Mobile Applications. Copyright 2012, Oracle and/or its affiliates. All rights reserved.

Transcription

1 Applying Identity to Secure Mobile Applications 1

2 This document is for informational purposes. It is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions. The development, release, and timing of any features or functionality described in this document remains at the sole discretion of Oracle. This document in any form, software or printed matter, contains proprietary information that is the exclusive property of Oracle. This document and information contained herein may not be disclosed, copied, reproduced or distributed to anyone outside Oracle without prior written consent of Oracle. This document is not part of your license agreement nor can it be incorporated into any contractual agreement with Oracle or its subsidiaries or affiliates. 2

3 Custom Brittle P o i n t 2 P o i n t E x p e n s i v e Internal Users Only Maintenance Not Scaleable Legacy Proprietary C l i e n t S e r v e r Fragmentation Inflexible Slow VPN Based First Generation Integration Rigid Hard Coded Status Quo 3

4 MOBILE APPLICATION ACCESS TODAY Complex Development VPN Based Higher Power Consumption Multiple Authentications VPN DOES NOT SCALE 7

5 State-full Cross-network Lower Energy Usage Device Independent REST INTERFACES SIMPLIFIES MOBILE APPS 8

6 Corporate DMZ Corporate Network Mobile Browser Webgate OAM Protected Resource Oracle Access Manager API Gateway Native Application Mobile and Social Data Interfaces / Oracle Entitlements Server Directory Services 9

7 CONTEXT AWARE AUTHENTICATION Account Detail Device Aware! Location Aware!? Time Aware! Device Fingerprint 10

8 PATIENT RECORD xxx xx x PATIENT RECORD 11

9 Select Login Authorize 12

10 Name: REAL EXAMPLE CONNECTING COLLEGE TEST PREP STUDENTS College: Major: Minor: Graduation Date: or Login with Facebook Student Advisor: High School: Test Date: Submit 13

11 Blacklist Devices Better Experience Single Point of Revocation 14

12 MONITORING & REPORTING 15

13 Alerts Location Risk Access Trends Browser & OS statistics 16

14 REST OPTIMIZE COMMUNICATION SECURE LOGIN MONITOR ACCESS 17

15 Access Management Device Tracking Device Registration White\Black List Platform Security Services GPS & WIFI Location Mobile Interfaces KBA & OTP Directory Services User Registration White Pages 18

16 Facebook G a d g e t s u m b l r kedin Curation Mixi I nstagram Search Engine Optimization Advertisements Games Twitter Promotions G o o g l e + Pinterest U R L S h o r t e n e r s S o c i a l P u b l i s h i n g Social Marketing Renren 19

17 Facebook MySpace WordPress Yahoo! V e r i s i g n Pinterest Yahoo! Mixi I nstagram flikr G o o g l e M y O p e n I D AOL 20

18 Facebook G a d g e t s u m b l r kedin Curation Mixi I nstagram Search Engine Optimization Advertisements Games Twitter Promotions G o o g l e + Pinterest U R L S h o r t e n e r s S o c i a l P u b l i s h i n g Social Marketing Renren 21

19 Facebook Yahoo! MySpace Photobucket Twitter N e t f l i x Dropbox SmugMug Y a m m e r Evernote LinkedIn TripIt OpenSocial G o o g l e Vimeo 22

20 Mobile Identity SDK 23

21 OVERVIEW REST SSO Tokens IOS & ANDROID STANDARDS SUPPORT for faster application development to connect social, mobile & enterprise identity multiple services integrate 24

22 TWO OPTIONS BROWSER & NATIVE APP APP 2012, Oracle 25 and/or Copyright its affiliates. 2012, All rights Oracle reserved. and/or its affiliates. All rights reserved.

23 IDENTITY MOBILE Tokens Authentication CRUD Operations Custom Operations IDP Selector User Registration Session Creation Policy Lifecycle Web Access Identity Admin Directory Services External Authorization Adaptive Access 26

24 CAPABILITIES Access Manager token support native auth dialogs Mobile Social + Access Manager Mobile Social + Access Manager + OAAM Mobile & Social Only Mobile + Social + OAAM JWT Token Support Authn & AuthZ Device Fingerprinting Device Security checks during registration, access requests Advanced security checks including geo-location etc KBA + OTP Directory Server User Profile Support Relying 3 rd party supports IDPs(facebook, linkedin, twitter) 29

25 NATIVE 30

26 31

27 TRY IT YOURSELF 33

28 PACKAGE itunes Store: As part of ios Developer Program In-House Apps: Register for ios Developer Enterprise Program: Create an enterprise distribution provisioning profile that authorizes devices to use apps you ve signed. Build the app with the provisioning profile. Deploy the app to your users. for step by step guidance. 34

29 WE CAN HELP YOU GET STARTED SCHEDULE SCHEDULE A 35

30 Download Oracle IDM Mobile SDK Download and install OIC server from Download Oracle IDM Mobile SDK to a developer machine running MacOS 10.6.x or higher from Oracle IDM Mobile SDK for ios is available as static library libidmmobilesdk.a 37

31 Configuring Server Side Create a HelloWorld application profile using OIC Admin Console at Register HelloWorld App into the MobileServiceDomain Create a Test User in OAM repository using Weblogic Admin console at Watch demo viewlet : OIC configuration for HelloWorld Mobile App: 38

32 Writing the HelloWorld Application Download libidmmobilesdk.a and add it your Xcode Project Add linker flags -ObjC all_load to your project. Initialize Mobile SDK Start Authentication process with OIC Server Obtain SSO token from OIC Server Build, compile and link your project Watch Viewlet How to Build a HellOIC App in Xcode: 39

33 Initializing Oracle IDM Mobile SDK Initialize SDK with OIC server details, app name, and the delegate to which authentication details have to be passed: NSURL *url = [[NSURL alloc] initwithstring:@" NSString *appname = [[NSString alloc] initwithstring:@"dmvapp"]; NSString *domain = [[NSString alloc] initwithstring:@"sativenk-oam"]; OMMobileSecurityService *mss = [[OMMobileSecurityService alloc] initwithurl:url appname:appname domain:domain delegate:self]; 40

34 Starting the Authentication Process Presenting authentication view controller triggers the authentication process by prompting user to enter credentials If OIC server is configured to trigger Knowledge Based Authentication, SDK takes care of that as well. UINavigationController *nc = [self.mobileservices getauthenticationviewcontroller:nil error:&error]; //Present authentication view controller using presentmodalviewcontroller // method of your presenter view controller logincontroller.modalpresentationstyle = UIModalPresentationFormSheet; //This triggers the authentication process [presenterviewcontroller presentmodalviewcontroller:logincontroller animated:yes]; 41

35 Finishing Authentication with a SSO Token After the authentication process, your delegate s didfinishauthentication method is invoked Now you are all set to use your application s web service call using the token obtained from OIC server. (void) didfinishauthentication:(omauthenticationcontext *)context error:(nserror *) error { // This example gets authenticated user s attributes and presents it using User Profile Viewer OMUserRoleProfileService* ups = [mss userroleprofileservice]; OMUserManager *um = [ups getusermanager]; OMUser *user = [um searchuser:context.username attributes:nil shouldprefetch:no error:&error]; self.user = user; [detailpanecontroller showprofilebutton]; } 42

36 Download Sample Applications and Code Samples Visit 43

37 blogs.oracle.com/oracleidm 44

38 45