BlackBerry Dynamics utility class. More...
The BlackBerry Dynamics authentication token mechanism enables applications to utilize the user identification that takes place during BlackBerry Dynamics authorization processing. This enables an application server at the enterprise to authenticate the user without the need for entry of any additional credentials at the device or desktop.
See below for an overall description of the BlackBerry Dynamics authentication token mechanism. This class includes the programming interface for requesting tokens.
The BlackBerry Dynamics platform includes rigorous authentication of the end user. This is used when, for example, identifying whether the user is entitled to run the current application, and when applying security policies.
The BlackBerry Dynamics Authentication Token (BlackBerry Dynamics auth) mechanism enables applications to take advantage of the authentication processes of the platform.
BlackBerry Dynamics auth tokens can be requested by the application on the device or desktop. A token will only be issued if authorization processing has completed, and the end user's identity has been authenticated.
Once a token has been issued, the application can send the token to an application server at the back end. The token can then be checked by the application server, using a verification service provided by the BlackBerry Dynamics infrastructure.
The sequence of programming interfaces used in BlackBerry Dynamics auth is as follows.
This sequence validates the end user's identity, and the application server can therefore grant access to resources and other permissions.
Calling the verification service doesn't cause the token to be consumed.
Note that a BlackBerry Dynamics application can obtain the identifier of the end user from the GDAppConfigKeyUserId
value in the collection returned by the GDAndroid.getApplicationConfig method.
A challenge string can be included in a BlackBerry Dynamics auth token request. The same challenge string will then be provided to the application server, in the response from the verification service.
The challenge string could have a number of uses for application developers. A typical usage could be to tie an instance of authentication to a previous access request, as follows:
In the above, a new random challenge string is generated on every resource access attempt. This has the effect of making the BlackBerry Dynamics auth tokens one-use. A more advanced algorithm might be to store the token and challenge string in the server, as a session identifier. To end a session, the server could delete the stored token and challenge string, effectively forcing the application to generate a new token, based on a new challenge string, when it next connected.
The verification service provides the challenge string to the application server in an HTTP header, which limits the character set that can be utilized safely. All letters and numerals in the ASCII range 32 to 126 can be utilized safely. Use of other characters isn't supported.
The BlackBerry Dynamics Shared User ID is a unique identifier for all containers which are provisioned for the same user on the same device.
Shared identifier will not be shared among different Work profiles on the same device
Public Member Functions | |
void | getGDAuthToken (final String challenge, final String serverName, final GDAuthTokenCallback callback) |
BlackBerry Dynamics authentication token request. More... | |
String | getDynamicsSharedUserID () throws GDNotAuthorizedError |
Get User Dynamics Shared identifier. More... | |
Static Public Member Functions | |
static void | getEIDToken (final String clientID, final String scope, String resourceServer, BBDJWTokenCallback callback, boolean refresh) |
Get JWT from BlackBerry Enterprise Identity (EID) server. More... | |
void getGDAuthToken | ( | final String | challenge, |
final String | serverName, | ||
final GDAuthTokenCallback | callback | ||
) |
Call this method to request a new BlackBerry Dynamics authentication token. Pass the challenge string and server name as parameters.
See under BlackBerry Dynamics Authentication Token Mechanism, above, for background on tokens and the challenge string.
This method requests a BlackBerry Dynamics authentication token from the BlackBerry Dynamics runtime. The runtime might connect to the BlackBerry Dynamics infrastructure installed at the enterprise in order to service the request.
The request is asynchronous. If the request succeeds, the token will be passed to the onGDAuthTokenSuccess callback in the listener. If the attempt fails, an error will be passed to the onGDAuthTokenFailure callback in the listener instead.
challenge | String containing the challenge string for the token. The challenge string can be empty. |
serverName | String containing additional identification, by convention the fully qualified domain name of the application server for which a token is being requested. Whatever value is passed here will also be returned to the server as part of the token validation response. |
callback | Reference to the listener, typically this . |
|
static |
Call this method to request a BlackBerry Enterprise Identity JWT Bearer Token for authentication purposes. Pass a registered client ID string, scope string and closure reference (for calling back) as parameters. Tokens are cached until expired, but a new token from the server may be specified by setting the refresh flag true.
This method requests a BlackBerry Dynamics JWT from the BlackBerry Dynamics runtime. The runtime might connect to the BlackBerry Dynamics infrastructure installed at the enterprise in order to service the request.
The request is asynchronous.
clientID | String containing the client ID. |
scope | String the scope for the token. |
resourceServer | String optional resource server specifier (not currently used) |
callback | Reference to an implementation of BBDJWTokenCallback which implements BBDJWTCallback(String JWT, Integer status, Integer error), typically this . |
refresh | A flag to force a new token to be fetched from the server. |
String getDynamicsSharedUserID | ( | ) | throws GDNotAuthorizedError |
Call this method to get a BlackBerry Dynamics shared user identifier.
See under BlackBerry Dynamics Shared User Identifier, above, for background on shared id usage and characteristics.
If calculation of shared id is not possible, empty string will be returned
com.good.gd.error.GDNotAuthorizedError | if BlackBerry Dynamics authorization processing has not yet completed. |