How to Stop Reinventing the Auth Wheel

Tuesday, September 3, 13

An iOS Authentication Architecture for All

How to stop reinventing the auth wheel


Great Apps


What makes an app

truly great?


AmazingFirst Impressions


Reliableand

Secure


Connected


Personal


WHAT’S THE BIG DEAL?


Identity has a Roleto Play


But, There’s A ProblemTuesday, September 3, 13

It’s ComplicatedTuesday, September 3, 13

So we end up like...



Instead we should...


SpendTime

Building Features

that ROCK


The good news...


PatternThere’s a

for That


‘Simplicity is the ultimate sophistication.’

- Steve Jobs


So, auth is complicated.


Why?


It’s not our core competency.


Tons AND TONS of Detail.


Never stops evolving.


and so...


we spend a lot of time


and, we get frustrated.


Not only is it complicated,


it can lead to poor user experiences.


like...


The WallTuesday, September 3, 13

Account creationTuesday, September 3, 13

Error Message: Your Password Must Be at Least 18770 Characters and Cannot Repeat Any of Your Previous 30689 Passwords

PasswordsTuesday, September 3, 13

However,the big issue is...




So what do we need?


Tools, APIs, & Services


That are...


Easy & Secure


Simple. Accessible.


Rely on ExpertsTuesday, September 3, 13

Is there a painkiller?



But first...



Fav MOV


Demo


/RCacheaux/FAVMOV



Ok. Let’s personalize.


Need Username and Profile Photo


To be or not to be custom is the question.


Identity Provider



Salt & Hash Passwords

Provide Two Factor Auth

Use Modern Irreversible Hash Function

Automatic Monitors

Operate Help Desk



Choose WiselyTuesday, September 3, 13

Relying Party


Ok. Enough Vocabulary


1

2

3

4

Pick an Identity Provider

Register Client

Incorporate API

Code Against API

Using an Identity Provider


Let’s pick an IDP...




Authenticationvs

Authorization


Scoping


Demo


‘That’s great, but what if my users don’t have

Facebook accounts.’


Let’s pick another IDP...


ARCHITECTURE


Before, let’s walk through the code.


Demo


Now we can hold another IDP, which one?




ARCHITECTURE


Accounts Framework


Recommended Identity Providers


What if my identity provider does not have an iOS API?






So you want a serverTuesday, September 3, 13

Backend as a Service



Now, you need custom accounts.


Sign In vs Sign Up


What about custom back-ends?





1

2

3

Secrets & Tokens

Single Sign On

Two Factor Authentication


1

2

3

Secrets & Tokens

Single Sign On





Get,Store, Use


Getting Tokens


Basic HTTP Authentication



The Access TokenTuesday, September 3, 13

A word about OAuth 1


OAUTH 1Tuesday, September 3, 13

Where to Store?


The KeychainTuesday, September 3, 13

The Operating System


Server-side


Browser Cookies


The FlowsTuesday, September 3, 13

App App App App

IDP App Browser

UIWebView

OS


How to Use Tokens


HTTP Authentication


1

2

3

Secrets & Tokens

Single Sign On



1

2

3

Secrets & Tokens

Single Sign On



Sharable Tokens


Across Apps


Across DevicesTuesday, September 3, 13

Across Platforms


1

2

3

Secrets & Tokens

Single Sign On



1

2

3

Secrets & Tokens

Single Sign On






The future


biometrics


ID


More in accounts framework


Less Custom Accounts


Account Chooser


cross Platform sign on


WHAT’S THE BIG DEAL?


Taking care of identity has many

benefits...


Improve Lives


More Usage





Less of this


And More of this


remember


delight your users


Resources




http://www.ietf.org/rfc/rfc6749.txtOAuth 2.0 RFC

http://www.ietf.org/rfc/rfc2617.txtHTTP Authentication RFC

http://openid.net/connect/OpenID Connect


http://tools.ietf.org/html/rfc6749












Twitter IntegrationWWDC 2011

Integrating With Facebook, Twitter and Sina Weibo

WWDC 2012

Protecting Secrets with the KeychainWWDC 2013




















Google IO 2013

https://developers.google.com/live/shows/576883641Identity Tech Overview: Less Pain, More Gain

https://developers.google.com/live/shows/601975672

How to Offer Google+ Sign-In Alongside Other Social Sign-In Services








http://www.parse.comParse

http://www.windowsazure.com/en-us/develop/mobile/

Windows Azure Mobile Services

Backend as a Service












http://www.accountchooser.comAccount Chooser

https://www.tbray.org/ongoing/Tim Bray’s Ongoing Blog










https://code.google.com/p/gtm-oauth/GTM OAuth

https://github.com/facebook/facebook-ios-sdkFacebook iOS SDK

Libraries

https://developers.google.com/+/Google+ Sign In
















/RCacheaux/FAVMOV


René CacheauxiOS [email protected]

[email protected]@RCachATX


mailto:[email protected]







How to Stop Reinventing the Auth Wheel

Technology