Security

Blog
Security
Monday, January 23, 2017PrintSubscribe
Identity Manager for Web and Mobile Apps

The user identity manager comes standard in applications created with Code On Time starting with the release 8.5.12.0.

User context menu in the app with Touch UI 2017 created with Code On Time.

The account management screen enables users to switch identity at will. Account Manager may optionally store encrypted login token to enable automatic login on mobile and desktop devices. Users can see all stored identities and have them removed as needed. Issued login tokens can be also invalidated remotely. Every signing into the app will create a fresh “login” token, which replaces the last used for the user name.

image

New accounts (logins) can be added directly in the account manager.

Login in an app with Touch UI 2017.

Account Manager works on any form factor:

Account Manager in the app with Touch UI on a mobile device.

The devices with the small form factor will display the current user identity in the “hamburger” menu.

Current user identity is displayed in the "hamburger" menu.   

User identity management options available through the "hamburger" menu.

Offline applications created with Code On Time are passing the  login token in the header of requests to read/write data. Offline app pages are stored directly in the device and cannot pariticipate in the session management of the server-side application components. Thus every request needs to provide an authentication information to access protected resources.

This new mechanism replaces persistent identity cookies of ASP.NET, whcih have been previously used for persistent login in apps created with Code On Time.

The accounts start being persisted on the device when the user selects “Remember me next time” option on the login screen. New touch-settins.json configuration file provides an easy way to disable account manager when needed.

Monday, January 2, 2017PrintSubscribe
Authenticating Users with Windows Live

Every application requires a list of user accounts that have been granted (or denied) access to the data. In order to maintain membership consistency, every user needs to be associated with a password. Recommended practices for passwords dictate that every password must be unique, contain a long series of mixed alphanumeric characters, and that users should change their passwords regularly. It is likely that many users do not follow these recommended practices, and tend to reuse simple and easy to remember passwords across various systems. This can lead to a security issue if one of the systems becomes compromised – malicious users can then gain access to all systems that share the same password.

In an attempt to solve solutions to the problems mentioned above, authentication can be delegated to a “higher authority”. Application admins can register their app to accept responses from a federated authentication server. When a new user attempts to sign up to the application, they can choose to register an account using their federated account. They will be redirected to the authentication server’s login page, and grant permission for the app to gain access to their email. This information is then used to automatically create an account in the app and sign them in. Therefore, the user simply has to ensure that their account in the federated system is secure.

Applications created with Code On Time can use OAuth 2.0 to register their users. Simply define a resource under the Content Management System (CMS) that lists your client ID, client secret, and redirect URI. A local redirect URI can be defined for testing purposes.

Registering Your App

The first step to enable Windows Live authentication is to register your app.

Navigate to https://apps.dev.microsoft.com. In the top-right corner, press “Add an App”. Enter a name for your app and press “Create Application”.

Adding an application to Windows Live.

Under the “Application Secrets” section, press “Generate New Password”.

Generating a new password for the application.

Make sure to copy the new secret.

Next, press “Add Platform” under the “Platforms” section. Select “Web”.

Adding a platform for the app.

Enter your application URI, with the path “/appservices/saas/windowslive”. Optionally add a local URI for testing purposes.

Adding redirect URI for the app.

Scroll to the bottom of the page, and press “Save”.

Enabling Windows Live Login in the App

The connection needs to be registered in your application. Navigate to the Site Content page of your app, and create a new record with the following settings:

Property Value
File Name windowslive
Path sys/saas
Text

Client Id:
1234567890

Client Secret:
12345mysecret67890

Redirect Uri:  
https://demo.codeontime.com/appservices/saas/windowslive

Local Redirect Uri:
http://localhost:31733/appservices/saas/windowslive

Make sure to change the Text to the correct values for your app.

Logging In with Windows Live

Log out of your app, and press Login to open the login form. The “LOGIN WITH WINDOWS LIVE” action will now be displayed.

The login form now displays a button to "LOGIN WITH WINDOWS LIVE".

Press “LOGIN WITH WINDOWS LIVE”, and you will be redirected to the Windows Live login screen. Once logged in, a permission request will be displayed.

Windows Live displays a permission request - the app is requesting access to the profile's email.

Press “Yes”, and your browser will be redirected back to the app. The app will attempt to sign in with the account matching the returned email. If no account is found, then an account will be created with the email as the username, and a random GUID assigned to the password and password answer.

Monday, January 2, 2017PrintSubscribe
Authenticating Users With Facebook

Every application requires a list of user accounts that have been granted (or denied) access to the data. In order to maintain membership consistency, every user needs to be associated with a password. Recommended practices for passwords dictate that every password must be unique, contain a long series of mixed alphanumeric characters, and that users should change their passwords regularly. It is likely that many users do not follow these recommended practices, and tend to reuse simple and easy to remember passwords across various systems. This can lead to a security issue if one of the systems becomes compromised – malicious users can then gain access to all systems that share the same password.

In an attempt to solve solutions to the problems mentioned above, authentication can be delegated to a “higher authority”. Application admins can register their app to accept responses from a federated authentication server. When a new user attempts to sign up to the application, they can choose to register an account using their federated account. They will be redirected to the authentication server’s login page, and grant permission for the app to gain access to their email. This information is then used to automatically create an account in the app and sign them in. Therefore, the user simply has to ensure that their account in the federated system is secure.

Applications created with Code On Time can use OAuth 2.0 to register their users. Simply define a resource under the Content Management System (CMS) that lists your client ID, client secret, and redirect URI. A local redirect URI can be defined for testing purposes.

Registering Your App With Facebook

The first step to configuring Facebook Login is to register your app with Facebook. Navigate to https://developers.facebook.com. In the top-right corner, hover over “My Apps” and press “Add a New App”.

Creating a new app in the Facebook Developers website.

Specify a Display Name, Contact Email, and Category, and press “Create App ID”.

On the “Add Product” screen, press “Get Started” next to “Facebook Login”.

Getting started with Facebook Login.

Under “Valid OAuth redirect URIs”, add a URI for your app URL, with the path “/appservices/saas/facebook”. It is recommended to add a test redirect URI when running the app locally on your PC.

Configuring OAuth for the application.

Next, press “Dashboard” section on the navbar on the left side of the screen. Take note of the App ID and App Secret values.

Finding the App ID and App Secrets.

Enabling Facebook Authentication in your App

Navigate to your website, and navigate to your Site Content page. Create a new record with the following properties:

Property Value
File Name facebook
Path sys/saas
Text

Client Id:
1234567890

Client Secret:
12345mysecret67890

Redirect Uri:  
https://demo.codeontime.com/appservices/saas/facebook

Local Redirect Uri:
http://localhost:30195/appservices/saas/facebook

Make sure to replace the values in the “Text” property with the correct values for your app. Save the new record, and log out of the app.

Logging In With Facebook

On the login screen, the “LOGIN WITH FACEBOOK” action will now be displayed at the top of the form.

Logging in with Facebook from the Login screen

Press the “LOGIN WITH FACEBOOK” button, and the app will redirect to authenticate with Facebook. Once signed in, it will display a permissions popup.

Facebook is requesting the user to grant access to the application.

Press “Continue as XXX” button to grant access to your profile and email address for that app. It will redirect back to your app and attempt to log in as a user with that email. If the user does not exist, it will be created. The password and password answer will be randomly generated.

Note that in order to allow Facebook users other than the app creator to authenticate with the app, the app must be marked as “Public” under the App Review section of the developer site.