Worklight Adapter Authentication in one session shared across another

1
votes

Worklight 6.1.0.1, and using Chrome based simulator to start the mobile web application. Application and adapters deployed from WL studio to the WL development Server.

I have a secure adapter procedure(s) and I've tested with two configurations:

<procedure requestTimeoutInSeconds="20" name="getBaseData" securityTest="Connections-securityTest"/>
<procedure requestTimeoutInSeconds="20" name="getCommunityMembersOf" securityTest="Connections-securityTest"/>

and

<procedure connectAs="endUser" requestTimeoutInSeconds="20" name="getBasetData" securityTest="Connections-securityTest"/>
<procedure connectAs="endUser" requestTimeoutInSeconds="20" name="getCommunityMembersOf" securityTest="Connections-securityTest"/>

getBaseData simply creates the active user (including id + pwd for later use), and returns fixed data to the app. getCommunityMemberOf is an https adapter that retrieves data from a backend server. This adapter retrieves the id + pwd from the active user and includes this information as input to the https request.

I start the first chrome simulator session with the javascript console showing that the application invoked procedure getBaseData. The credentials are collected and authenticated, and setActiveUser is completed. The application then invokes procedure getCommunityMembersOf and this procedure call processes with no authentication, as expected.

I start a second chrome simulator session for the same application and the javascript console shows that the invoke procedure getBaseData is not challenged, and is processed which seems to indicate that the authentication completed indicating simulator session #1 authentication also satisfied simulator session #2 authentication. This is a behavior I want to prevent and have both simulator session require authentication independently. Appreciate any advice about why this is happening, and what I can do to prevent this session sharing. Thank You.

1
ibm-mobilefirstworklight-adaptersworklight-security
To be clear, you've tested with both configurations and the result is the same, or...? - Idan Adar
The Same. I confirm the behavior by viewing the javascript console, and see log statements I have in my challenge handler. With both config setups I see the console logs from the challenge handler(CH) with the 1st instance of the app, and I don't see any CH console logs from the 2nd app instance. Please let me know if I should alter my test scenario or turn up any trace settings that may help. The test is pretty basic by calling the adapters during wlConnonInit. The data returns fine, but I see no challenge for the 2nd instance of the app when it starts, and adapters return data just fine. - Michael Mirt
Idan, I ran a similar test using the Getting Started AdapterBasedAuth project -> SingleStepAuth App. I modified SingleStepAuthAdapter.xml and updated: <procedure connectAs="endUser" name="getSecretData" securityTest="SingleStepAuthAdapter-securityTest"/> Deploying the adapter I receive server console WARNING: FWLSE0103W: Procedure 'getSecretData' will always require authentication when connectAs='endUser'. [project AdapterBasedAuth] (as expected) I run the same 2 Chrome browser test and the 1st test is challenged for credentials, and the 2nd browser test receives no challenge. - Michael Mirt
Can you elaborate more on what you mean by "simulator session" ? Once you've logged in Chrome stores session cookie. In case you open a new tab with same app you will remain logged in since session cookie is reused. You can check your session cookies in Chrome debug tools under Resources -> Cookies - Anton
Simulator, is Mobile Browser Simulator invoked from the Worklight console. (Updated Test) Deploy the test app to my Nexus7 and when running one session from my device, and one session from Chrome I do not see the issue (with endUser and without endUser) so using browsers to validate this behavior is not a good approach (My Mistake). Now, when I run my tests using endUser, and without endUser I see no difference in behavior, both scenarios result in a challenge. Can someone explain what behavior to expect with a secure procedure with and without endUser set? Thanks.. - Michael Mirt

1 Answers

3
votes

Chrome is sharing the session between the different tabs, it has nothing to do with Worklight.

What you can do is open a new browser in incognito mode to prevent sharing the session. Or open a different kind of browser.