User SSO Native Mobile App and Web Portal

[emanuele_matino]

Hi,

My system is composed by two main application:

• Native Mobile Application
• Web Portal Application

The Native Mobile Application to communicate with the backend use the service on Sap Cloud Platform named "Mobile Services".

To make the User login is implemented a REST procedure to open the standard login web view and the user put the login e password as usual:

This is called from the link "https://mobile-zzzzz.hana.ondemand.com/odata/applications/v4/dh1_mobile_customers/Connections" and return a specific tag named "X-SMP-APPCID" that I save locally and put always into cookies of my following REST calls to the mobile services.

In this way I don't need to request always the Username and Password to the user.

Now if I redirect the user to the portal (so I open a direct link from the app into the web browser), appear again the login view at the same identity provider link (SCI) of mobile APP and the user need to insert again User and Password input. After that the user can access to porta application.

There is a way to make only one login to the user both mobile application services and web portal application? (SSO)

There is a way to get some cockies equivalent for both application?

Thanks in advance.

Regards.

Emanuele

[Colt]

Hi Emanuele,

after initial authentication of the user on the IDP, the requirement should be solved when using an OAuth access token or SAML assertion on the mobile device. From your description it is not clear which authentication you are using.

Cheers Carsten

[emanuele_matino]

Hi Carsten

I use SAML2 IDP.

The problem is that if I change application on my mobile device I can't use the SSO on both MyProduction App and a Browser App.

After I did an authentication on app side, I click on a button that call an external browser to the same IDP, but ask always the User and Password.

Regars

[LutzR]

Hi Emanuele,

when you open the browser from your native app, you might be able to put something into the HTTP request that could authenticate the user. Some kind of token/ticket/assertion that the started application or the IDP might be able to evaluate e.g your X-SMP-APPCID. Carsten's OAUTH access token and SAML2 assertion are also in this category (Carsten is more into details than I am).

SSO bridges between different technologies are typically built like this.You "just" need to find out some kind of "common denominator".

Cheers, Lutz