Does MobileFirst authentication framework provide any option to explicitly bypass the security check for specific resources?

0
votes

I am using IBM MobileFirst platform 7 to develop a hybrid application for one of my clients. I am using the below environment setting to protect the app so that on app launch when it connects to the MobileFirst server, app will receive a security challenge from the server.

<iphone bundleId="com.AppTest" version="1.0" securityTest="mobileTests">

The app handles the challenge by showing the login screen to the user. I am using adapter based authentication for the app. This is working fine.

Problem with the above setup: There is a 'New user sign-up' link in the login screen that redirect the user to a sign-up screen. On load of the user sign-up screen, app is invoking an adapter procedure to get some data. The adapter procedure invoked from the sign-up screen is not protected with any security test.

Even though the adapter procedure is unprotected, the above setup doesn't allow the app to invoke the procedure before a successful user authentication. Server is throwing a challenge back to the app when the user clicks on the registration link and he stays on the login screen.

Does MobileFirst authentication framework provide any option to explicitly bypass the security check for specific resources while using environment level protection? I have gone through the platform documentation and couldn't find any such options. If anyone faced a similar problem and resolved it, could you share your suggestions on handling this please. Thanks.

1
ibm-mobilefirst

1 Answers

1
votes

The adapter procedure invoked from the sign-up screen is not protected with any security test.

Does that mean that the specific procedure has no securityTest assigned to it? If so, you can try setting it as securityTest="wl_unprotected". Even if not explicitly setting a securityTest, there still default security assigned internally. To disable that try the mentioned wl_unprotected suggestion.

Read more here: Understanding predefined Worklight authentication realms and security tests

Setting securityTest value to wl_unprotected means that the resource will not be protected by any of Worklight platform security mechanisms. This security test cannot be used to protect application environments and event sources as they both require user and device identities. Usually this security test is used to protect adapter procedures that should be publicly accessible without any authentication requirements.