THE NEW DIGITAL EXPERIENCE

Transcription

1 SECURING THE NEW DIGITAL EXPERIENCE Steffo Weber, Oracle & Max Liesegang, esentri Tuesday, 21-May-2013 Latest Entries Mobile & Social Apps Protecting IDPs from malformed SAML requests Read more Write secure code, don t write security code. Read more Fine-grained authorization and XACML. Read more Tuning the industry s most trusted directory server. Read more Hands-On SOA and Web Security. Read more Harnessing Sun s OpenSSO Authentication and Authorization. Read more

2 Overview Motivation Foundation Experience What for? UI vs UX vs Security Channels OAuth XCode How long? How complicated? Alternatives

3 M Motivation Importance of mobile access management

4 Motivation Evolution of UX Pro Prosumer Consumer Information & Data Design Graphical UI User Experienced Design

5 Motivation Why UX is not UI Touchscreen with GUI Application (MVC) Background Services (REST)

6 Motivation Some findings (hypothesis first) 13.6 million tablets shipped to enterprises (2011) 96.3 million tablets shipped to enterprises (2016) Mobile Apps. What Consumers really want (Compuware)

7 Motivation Some findings (hypothesis first) 85% prefer mobile apps over mobile websites 79% will not retry an app if the failed once or twice 48% will delete an app if it is too slow Mobile Apps. What Consumers really want (Compuware)

8 Consumer Don't make me think.

9 Buying process and corresponding identity. Recognition 1.Problem/Need 2.Information Search of Alternatives 3.Evaluation 4.Purchase Decision 5.Post-purchase Behaviour? Social ID Social ID Web Trail Social ID Web Trail Address Billing Rel Social ID Web Trail Address Billing Rel Customer ID This is where real identity comes into play.

10 Customer Loyalty UX Security CRM

11 Customer Loyalty Advice: all channels are equal. mobile sites, mobile apps, Cookies, web SSO Multiple apps traditional channels. Cookies, web SSO

12 Customer Loyalty Advice: all channels are equal. WebSSO Access Management (WAM) Mobile Access Management ios built-in Kerberos

13 Customer Loyalty Advice: all channels are equal. Unified Access Management

14 Φ Foundation How to achieve SSO for multiple apps?

15 Foundation

16 Foundation Presentation Business/ Services Data

17 Foundation In a browser world, we don t access services layers directly. Presentation Business/ Services Data

18 Foundation In a browser world, we don t access services layers directly. Presentation Business/ Services Data

19 Foundation In a browser world, we don t access services layers directly. Presentation Business/ Services Data

20 Foundation In a browser world, we don t access services layers directly. Presentation Business/ Services Data Accessing the services layer from untrusted devices exposes new risks. iphone is the new presention layer

21 Foundation In a browser world, we don t access services layers directly. Presentation Business/ Services Data Accessing the services layer from untrusted devices exposes new risks. iphone is the new presention layer No trust between ext DMZ and service zone.

22 Foundation OAuth concepts one user token vs. multiple access tokens

23 Foundation ios/andoid App SSO Agent Mobile & Social REST WebService User starts App A Who is the SSO Agent on this iphone? You can reach it via URL scheme agent:// B C agent://<get access token> If user has not been authn, present login dialog and request user token. D1 If user token is present, get access token for app/service. D2 F Issue access token Forward access token E2 Make REST call using libidmmobilesdk. Access token is inserted automatically by SDK E1

24 Foundation Service REST, SOAP, etc Oracle Access Manager Mobile & Social HTTP Call (intercepted) check for cookies check for JWT

25 Foundation Objective C Java RESTful Identity Services (CRUD, AuthN/Z, Token Services) Oracle Access Management Services libmobile Classical WebSSO REST/JSON/JWT/OAuth WebGate API Gateway w Mobile & Social Access Manager Adaptive Access Manager Entitlements Server (OpenAZ, XACML) Directory Services (LDAP) XACML/OpenAZ Oracle Service Bus OWSM (WS-Sec) Legacy Services SOAP-WS

26 Foundation Import libidmmobilesdk.a

27 Foundation Register a URL scheme

28 Foundation SSO relevant code in ios app #import "IDMMobileSDK.h" /* we (nonatomic,retain) OMMobileSecurityService *mobileservices; from header */ - (void)connecttooicserverandsetup { OMMobileSecurityService *mss = [[OMMobileSecurityService alloc] initwithurl:self.oicurl // e.g. appname:self.applicationname // e.g. SampleApp or Art domain:self.oicservicedomainname // e.g. MagServiceDomain delegate:self]; self.mobileservices = mss; UIBarButtonItem *rightbutton = [[UIBarButtonItem alloc] initwithtitle:@"login" style:uibarbuttonitemstylebordered target:self action:@selector(dologin:)]; } - (IBAction)doLogin:(id)object {.. NSError *error = nil; error = [self.mobileservices startauthenticationprocess:nil presenterviewcontroller:self];} Initialize app & load profile from central server Login button & event config Event handler - (void)didfinishauthentication:(omauthenticationcontext *)context error:(nserror *)error {... username = context.username; }

29 Σ Experience How long? How complex?

30 Experience How long did it take? Good Easy ios integration (SSO is transparent to the developer) Complete service protection No hazzle with Apple app store Suggested enhancements Currently uses old app delegate pattern

31 Experience How long did it take? 2 4 daysoracle Access Manager Mobile & Social day day 1 day

32 Experience What about ios 7 native SSO Requires Configuration Profile No Application Can Control Authentication Flow Customizable Authentication Experience and UI Mobile & Social Yes Yes ios Enterprise SSO Protocol OAuth, REST Kerberos only Adaptive Access Support Yes No Yes, only acceptable with MDM use cases Device Registration Yes MDM type registration with Configuration Profile Resources Definition Apps Definition Dynamic through Admin console Dynamic through Admin console No No Need to redistribute Configuration Profile to add new URLs Need to redistribute Configuration Profile to add new App Bundle Id, need to confirm whether wild card could cause security issue.

33 Identity Culture Mobile is the new black Will TV be the new mobile?