IBMWorklight Session Management

Question

We are trying to develop session management on IBMWorklight server. Following are our needs from session management system-

1. Session should be created once every user logs in using his credentials (username/password).
2. This session should be able to store session data of that particular user i.e. say session should save his credentials so that he need not to pass those again for accessing other services.
3. Session timeout should happen after certain time.

Our progress

1. Created a realm in authenticationConfig:

   <realm name="SimpleAuthRealm" loginModule="SimpleAuthLoginModule">
       <className>com.worklight.integration.auth.AdapterAuthenticator</className>
       <parameter name="login-function" value="SimpleAuthAdapter.onAuthRequired" />
       <parameter name="logout-function" value="SimpleAuthAdapter.onLogout" />
   </realm>
   

2. Created Login module in authenticationConfig:

   <loginModule name="SimpleAuthLoginModule">
               <className>com.worklight.core.auth.ext.NonValidatingLoginModule</className>
           </loginModule>
   

3. Created security test:

   <customSecurityTest name="SimpleAuthAdapterTest">
                  <test realm="SimpleAuthRealm" isInternalUserID="true"/>
              </customSecurityTest>
   

4. We have created a adapter with two procedure in it. Following is adapter.xml file

    <procedure name="requestForData" securityTest="SimpleAuthAdapterTest" />
   <procedure name="requestForOtherData" securityTest="SimpleAuthAdapterTest" />
   

5. Following is adapter implementation file:

    function onAuthRequired(headers, errorMessage) {
       WL.Logger.info("onAuthRequired(headers, errorMessage)----> START");
       WL.Logger.info("headers: " + JSON.stringify(headers));
       WL.Logger.info("errorMessage: " + errorMessage);
   
       errorMessage = errorMessage ? errorMessage : null;
   
       WL.Logger.info("onAuthRequired(headers, errorMessage)----> STOP");
       return {
           authRequired : true,
           errorMessage : errorMessage
       };
   }
   
   function submitAuthentication(username, password) {
   
       WL.Logger.info("submitAuthentication(username, password)----> START");
       WL.Logger.info("username: " + username);
       WL.Logger.info("password: " + password);
   
       if (username === "worklight" && password === "worklight") {
   
           WL.Logger.info("Login successfull");
   
           var userIdentity = {
               userId : username,
               displayName : username,
   
           };
   
           WL.Server.setActiveUser("SimpleAuthRealm", userIdentity);
   
           var response = {
               authRequired : false,
               errorMessage : ""
           };
   
           WL.Logger.info("submitAuthentication(username, password)----> STOP");
           WL.Logger.info("response: " + JSON.stringify(response));
   
           return response;
       }
   
       var response = {
           authRequired : true,
           errorMessage : "Invalid login credentials"
       };
   
       WL.Logger.info("submitAuthentication(username, password)----> STOP");
       WL.Logger.info("response: " + JSON.stringify(response));
       return response;
   }
   function onLogout() {
   
       WL.Logger.info("onLogout()---->START");
       WL.Server.setActiveUser("SimpleAuthRealm", null);
   
       //WL.Client.logout('SimpleAuthRealm');
       WL.Logger.info("onLogout()---->STOP");
   }
   

6. We have created dummy UI which includes login page and home page. Login button click will call submitAuthentication() service and migrates to home page. Home page consist of two buttons one to call requestForData() service and other for requestForOtherData() service.

Issues we are facing:

1. This flow demands first to call protected service e.g. requestForData and in response worklight server will throw challenge which we will clear by providing user's credential. We require other way round, we want to provide the user's credentials and start the session so that all the services protected by that realm(security test) should be accessible.
2. Once we clear challenge for first service we are able to call other service without providing user credentials, but while calling next service we are not passing any identification of calling client, this makes us believe that the session which is established in first service call challenge is for all/ any the user not not user specific. We need very very user specific session.

Please comment on if this is a good idea to maintain session on worklight middleware server as we are working on banking mobile application. Please suggest solutions on above...

Answer 1

For #1, consider setting a security test on all the app environments (in the application descriptor) and Calling WL.Client.connect when the app starts (you should be doing this anyway) This will trigger authentication when the app initially contacts the Worklight server. Once this is complete, you will be able to access adapters protected by security tests in the same realm without additional challenge.

For #2 when you establish the connection to the Worklight server, you create a session that the server tracks as yours, so even though you are not providing credentials again, the Worklight server knows which authenticated user makes each adapter call.