iOS auth/auth with a REST Webservice

Question

we're currently in the design phase of a new "Gateway-Server" which we want to develop. Our server has a REST-Service. My task is to find viable options to protect the access to the aforementionend REST Service (auth/auth)

This server is going to be used in a business environment which means we have an LDAP/Active Directory at our disposable. The informations which I are going to be served out via this API are high-valuable and should be adequatly protected on the device and on the server. The app and backend is going to be used by employees, there are no public users.

We are going to use an Application Server (Glassfish) as the base componente for our backend. I want to use the built-in security mechanisms as I want to avoid to invent my own solutions which are probably going to be inferior.

What is a best-practice to secure the backend from unauthorized/unauthenticated access?

Or more specifically:

• How could I secure the access to the backend?
• Is it an option to transmit the username and password with every request made from mobile device to backend?
• Is it good practice to validate the transmitted Username/Password against the LDAP?

Nice to know:

• The gateway-server is behind a reverse-proxy.
• User need to authenticate themselves with Username/Password when they want to replicate( connect to the backend)
• communication between device and backend is going to be protected with TLS

Thanks

Answer 1

There are common defects in authentication systems that should be avoided:

• In a corporate environment it is important to terminate authentication immediately. If an employee is fired they could seek revenge, and even a narrow window of access cloud be enough to cause serious monetary loss.
• Bruteforce. There must be a system in place to rate-limit authentication requests coming form a specific ip. Blocking requests until an IP can solve a capthca is a good approach that is used by Google and others.
• Leaking information over an insecure channel. This is mitigated by TLS (or HTTPS). TLS has its own problems and is always misconfigured by default. Make sure you are using secure cipher suites (TLS V1 or later) and disable renegotiation requests. Any vulnerability scanner worth its salt will show these violations, and they are a common finding in the wild.
• Injection and Authentication Bypass. Make sure you understand LDAP Injection.

Forcing every request to contain a username/password solves the first problem of immediate termination. If every request has to be sent to Active Directory then there is only once place to revoke access. LDAP is a very fast non-relational database and filter requests are very fast (much faster than SQL).