Saba Cloud. Overview of SSO for mobile applications

Transcription

1 Saba Cloud Overview of SSO for mobile applications

2 Introduction 2 Published: 05/13/2014 Part Number: U-SEC-1 Database management system:

3 TOC 3 Contents Chapter 1: SSO support by Saba Cloud mobile applications...5 What types of SSO are supported by the Saba Cloud mobile applications?...6 How do Saba Cloud mobile applications work in a SAML SSO-enabled environment?...6 What is the mobile user experience?...6 How do mobile applications interact with a SAML SSO-enabled Saba application?...7

4 4 TOC

5 Chapter 1 SSO support by Saba Cloud mobile applications Topics: What types of SSO are supported by the Saba Cloud mobile applications? How do Saba Cloud mobile applications work in a SAML SSO-enabled environment? This document is designed to answer your questions on the types of SSO supported by Saba Cloud native mobile applications and how it works.

6 SSO support by Saba Cloud mobile applications 6 What types of SSO are supported by the Saba Cloud mobile applications? Saba Cloud mobile applications only support SAML-based SSO. The token/certificate based SSO is not supported by the mobile applications. How do Saba Cloud mobile applications work in a SAML SSO-enabled environment? Note: The mobile applications do not support auto-login for SAML enabled tenant as we do not store password for SAML tenants. What is the mobile user experience? The following process describes user experience when logging in to a native mobile application to connect to a SAML-enabled environment. 1. After tapping the icon to open the application, a user is presented with a screen to enter the site/tenant name. Once the user clicks Enter, the mobile application validates the site/tenant name and checks whether the site is SAML SSO-enabled. 2. If the site/tenant is SAML-enabled, a third-party SAML provider login page opens within the mobile application. Once the user enters the login credentials and clicks Login, if the login credentials are valid, the user is granted access to the mobile application. Otherwise, the user stays in the same login page.

7 SSO support by Saba Cloud mobile applications 7 How do mobile applications interact with a SAML SSO-enabled Saba application? The following process describes how the mobile application authenticates users in a SAML-enabled environment. User Interaction Application Behaviour 1. After tapping the icon to open the applic~ ation, a user is presen~ ted with a screen to enter the tenant name. Once the user clicks Enter, the mobile ap~ plication validates the tenant name and checks whether the site is SAML SSO-enabled. Once the user inputs the site/tenant name, the mobile application first validates whether the name is correct using the tenant manager api. If the name is valid, the tenant manager api returns a JSON response that includes vanity url, socialfullurl and site name. All three values are preserved and used for the duration of the session. Next, the mobile application executes a REST API call to verify whether the site is SAML-enabled. For example: fig?sitename=<sitename> The JSON response indicates whether SAML is enabled for the particular site or not. For example: "issamlenabled": "true"

8 SSO support by Saba Cloud mobile applications 8 User Interaction Application Behaviour 2. If the site/tenant is If SAML is enabled, the Login page provided by a third-party SAML SAML-enabled, a vendor is obtained from the above JSON response. third-party SAML pro~ The URL for the login page is formed using the vanity URL obtained vider login page opens earlier from the tenant manager JSON. A web view is used to open within the mobile ap~ plication. the URL. The URL is opened embedded in the mobile application. The vanity URL looks as follows and redirects the user to a login page provided by a third-party SAML vendor. Once the user enters the login credentials and clicks Login, if the login credentials are Mobile=true. valid, the user is gran~ ted access to the mo~ If the user enters valid login credentials in the third-party SAML bile application. vendor login screen, the Saba server receives a successful authentic~ ation from the SAML vendor. Upon successful authentication, the Otherwise, the user Saba server generates a Saba Certificate and sends the following stays in the same login URL to the mobile application: page. tonative::sabacertificate::<actual_certific~ ate> The mobile application recognizes the URL starting with thetonat~ ive:: prefix and extracts the Saba Certificate from it. The certificate is stored by the mobile application for the duration of the session and is used for all REST API calls.