4

I built an iPhone app which transfers data via a REST web service (Jersey) via JSON objects to a Java middle tier back end...

Question(s):

(1) What is the best way to secure the login / authentication of this iPhone App?

(2) Is there an open source or commercial framework used to acquire this type of functionality?

So far I have come across OAuth, SAML and REST Identity Services

(3) Will this framework require SSL?

(4) Does it validate the client (not just the user)?

(5) Am I going about this the wrong way? Meaning should I just use an encrypted token which is required for every single REST call and install SSL?

Would really appreciate this if someone understands my plight and can help... I know that this can be done somehow on an iPhone app because Bank of America and Amazon have this same type of login feature and security.

Happy coding,

Mike

Improve this question
2
  • When you say login/authentication, do you mean with your applications's unique 'web service key' or are you talking about a per user username/password? Commented Jul 24, 2009 at 1:35
  • I mean both... The ability to secure every single REST API call and login/authentication. Commented Jul 27, 2009 at 10:28

2 Answers 2

Reset to default
1

I did a demo at JavaOne at the beginning of June that used Jersey on the server, OAuth (via OpenSSO) and a JavaFX client. The code is somewhat experimental, but it might be useful to you - see this blog entry - especially comment #2. There's also a video that explains it at a high level. I used XML, but, since OAuth works at the HTTP level, it works equally well for JSON.

BTW - there's an Objective C OAuth Consumer implementation - I haven't used it, but Pownce did.

Improve this answer
Sign up to request clarification or add additional context in comments.

3 Comments

Excellent! Thank you so much! I will check out your blog entry! One thing I don't understand is that you mentioned OpenSSO. Isn't that different than OAuth?
Outstanding! Would this be possible to do with Eclipse? I noticed your blog entry points to a configuration instructions (README file) and its all based using Netbeans... Thank you again!
OpenSSO is an open source project - it covers access management, federation and secure web services. OAuth is one of the protocols it implements - albeit in prototype form right now As far as Eclipse goes - I don't know - there might be Jersey support there, but I'm not sure. Sorry.
1

Many SSO schemes rely on url redirects that can be problematic in iPhone apps. Pownce folks tried using OAuth in their app and apparently the experience was confusing to the user. After some research I settled on an approach based on secure WSSE username tokens, the same approach that is used in Atom apps. Enjoy.

Improve this answer

Comments

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.