1

I have a Apache Cordova hybrid mobile app that needs to authenticate users, but we don't want to prompt for credentials every time the app is used.

Some options came to my mind:

  1. Store the password encrypted using public key cryptography, so only the server can decrypt it and perform authentication. However, I understand it's a bad practice that in the event that password gets compromised, the entire suite of applications using the SSO would be compromised.

  2. Use Client Certificate based authentication... Does it make sense?

Are there other choices?

Improve this question
1
  • 2
    If an attacker can get to the encrypted password and send it to the server without knowing the password, it won't help much. It's still a static shared secret.
    – Henning Klevjer
    Jul 1, 2014 at 6:04

1 Answer 1

Reset to default
1

You should look into token-based authentication. That is, tokens issued by an identity provider - not to be confused with security tokens that are generally used with multifactor authentication systems.

This authentication method eliminates the need to store a password in every client, yet provides the convenience of not having to prompt for credentials on every application start. This works by storing the access token on the client, which is presented to the server on every request and expires after a certain amount of time (e.g. 7 days).

This approach is similar to cookie-based authentication (like used with WS-Federation), with the important difference that it isn't prone to Cross-site request forgery (CSRF) attacks.

I highly recommend researching the OAuth standard.

Improve this answer
5
  • I was considering OAUTH, but IMO, it does not solve the problem, the reason being, with OAUTH, the authorizing application provides a set of information of the logged-in identity, like user profile etc. But, I need a auth token that can be used to identify the user in the server side.
    – Karthik Krishnan
    Jul 1, 2014 at 6:16
  • The OAuth token does contain a unique identifier - usually the user's username or email address, that can be used to query the associated account profile in your back end.
    – Steven Volckaert
    Jul 1, 2014 at 6:38
  • But I need more than just the Account Profile. To give a background, we are using OpenAM as Authentication AND Entitlements System. So once authenticated, I need to verify if the user has entitlements to a certain resource. This would need a proper "Authentication/SSO token" and just not a OAUTH Access Token.
    – Karthik Krishnan
    Jul 1, 2014 at 9:50
  • 1
    You're confusing authentication with authorization. The authorization requirement you mention is typically solved by querying a database in the back end on every request (sometimes caching the result is also an option). The input for that query is whatever uniquely identifies the user's account - usually the username or email address. That data is then used to validate whether a given resource can be accessed.
    – Steven Volckaert
    Jul 1, 2014 at 9:55
  • Authentication - Is about verifying if the user is who claims he is. And Authorization is about verifying if the authenticated user has privilege to access(read/write) a specific resource. In my case, OpenAM handles both Authentication as well as Authorization function. And to use Authorization function, you will have to provide the "auth-token" received as part of a successful authentication.
    – Karthik Krishnan
    Jul 2, 2014 at 4:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.