In order for enterprises to realize the productivity gains factored into the investment decisions for those applications, IT Managers must explore options for enabling single sign-on for their users. In this post, we’ll outline a mobile single sign-on (mSSO) pattern for enterprise iOS applications.

Assumptions

1. Your company has a centralized single sign-on service exposed on the network – LDAP, Novell Access Manager, etc. This approach will work with a number of identity management architectures, but you will need to tailor credential management accordingly. For this demo, our service calls are simulated with hardcoded tokens.
2. Your company has a standardized credential timeout period or a way of dynamically distributing that value to applications. For this demo, we’ll use a static 30 minute timeout period.
3. You are able to sign and distribute builds to a device. This is important because keychain activities do not function in the simulator.

Implementation

Approach

Our approach will consist of creating three applications – two mock business applications and one logout application. Each application may contain its own logout functionality, but a single logout application makes the user’s activity of killing a session intuitive. In practice, the mSSO pattern would be implemented as a stand-alone library which could be easily dropped into each of your various enterprise applications.

The business applications retrieve a unique authentication token which is included with each service request. This token will be stored in the device’s keychain, which will be shared across our suite of applications. We will also maintain an ‘expiration date’ within the keychain so that subsequent requests from our various apps can (if required) preemptively prompt the user to authenticate.

Authentication for this demo may be simplistic, but existing patterns cover implementing authentication in a service-based mobile application. For example, the ‘store credentials’ logic presented in this example would live somewhere in that pattern’s “authenticateOperation”.

One possible extension of the mSSO pattern is to confirm that your credentials have not expired before issuing a call to the service. You would use the mSSO pattern to sign your network requests, but rely on the service and response handlers to inform you that credentials have expired. Checking credential expiration prior to making a service call limits unnecessary network traffic.

Configuration

There are two key steps that must be completed in order for your applications to share keychain access.

1. Each application included in your mSSO effort must share a Bundle Seed ID, which allows shared keychain access between our suite of applications. This is configured within the iOS management portal. We’ll configure our applications using the default ‘Team ID’ selection.




2. We also need to enable and add an entitlements file that specifies that this application should be able to access the shared keychain. This step is done after the Xcode project has been created.
• Select your app target in Xcode and choose the ‘Summary’ tab.
• Choose ‘Enable Entitlements’ at the bottom.
• Set the Entitlements File name to “mSSO” and hit return. Select ‘Create’ when prompted.
• Unless needed for your application, remove iCloud configuration settings.
• Add a keychain value titled “mSSO”, our Bundle Seed ID is prepended to this value for us.

Development

We’ll walk through how to create App1 in detail, and then let you work through App2 and the Logout application. Let’s start by opening Xcode and creating a single view application. Before we get started, add the Security.framework and create your entitlement files as outlined above. Here is a good primer for interacting with the keychain.

1. Add the custom mSSOUtils and DateUtils classes as outlined below. Make sure that you import accordingly. Due to changes in iOS related to ARC (developer account required), you will need to disable ARC for the mSSOUtils class. You can do so by selecting your target in Xcode and viewing the Build Phases tab. Expand the Compile Sources section and double click the mSSOUtils class to add the -fno-objc-arc compiler flag. You may need to clean and build.
   mSSOUtils:

   #define kmSSOKeychainGroup @"3Q4M6DQ9WM.mSSO" #define kAuthenticationServiceName @"com.captechconsulting.msso" #define kCredentialToken @"mSSOAuthenticationToken" #define kCredentialExpiration @"mSSOCredentialsExpirationDate" #define kExpirationTimeout 60.0 * 30 // 30 minute timeout   // *** PRIVATE METHODS DEF *** // @interface mSSOUtils (Private) + (NSMutableDictionary *) keychainSearch:(NSString *)identifier; + (NSString *) getValueForIdentifier:(NSString *)identifer; + (BOOL) setValue:(NSString *)value forIdentifier:(NSString *)identifier; + (void) deleteValueForIdentifier:(NSString *)identifier; @end   @implementation mSSOUtils:   + (BOOL) authenticateWithUsername:(NSString *)username andPassword:(NSString *)password { // for testing purposes, each call to this method authenticates successfully   // set the token - app specific - change this in your App2 implementation if ([self setValue:@"TokenSetFromApp1" forIdentifier:kCredentialToken]) { // token set, now set the credential expiration [self extendCredentials]; } else { NSLog(@"Unable to set token."); }   return YES; }   + (void) logout { // destroy token AND expiration date [self deleteValueForIdentifier:kCredentialToken]; [self deleteValueForIdentifier:kCredentialExpiration]; }   // credential management + (void) extendCredentials { NSDate *newExpireDate = [DateUtils dateWithTimeout:kExpirationTimeout]; NSString *newExpireString = [DateUtils stringFromDate:newExpireDate withFormat:kDateFormat]; BOOL success = [self setValue:newExpireString forIdentifier:kCredentialExpiration]; if (!success) { NSLog(@"Unable to extend credentials."); } }   + (BOOL) credentialsExpired {   // if no token exists, call credentials expired if ([self credentialToken] == nil) { return YES; }   NSDate *expirationDate = [self credentialExpirationDate]; if (expirationDate) { // check for expiration return [DateUtils dateInPast:expirationDate]; }   // if there is no expiration date, default to 'expired' return YES; }     // sign the request with current credentials - we'll add the token as an HTTP header field + (NSMutableURLRequest *) signRequest:(NSMutableURLRequest *)request { NSString *token = [self credentialToken]; if (token) { [request addValue:token forHTTPHeaderField:@"auth-token"]; } return request; }   // methods to retrieve credential information + (NSString *) credentialToken { NSString *token = [self getValueForIdentifier:kCredentialToken]; return token; }   + (NSDate *) credentialExpirationDate { NSString *expirationDateString = [self getValueForIdentifier:kCredentialExpiration]; if (expirationDateString) { // convert to date return [DateUtils dateFromString:expirationDateString withFormat:kDateFormat]; } return nil; }   + (void) displayAuthenticateView:(UIViewController *)vc { authenticateViewController *authenticateView = [[authenticateViewController alloc] initWithNibName:@"authenticateViewController" bundle:nil]; UINavigationController *nc = [[UINavigationController alloc] initWithRootViewController:authenticateView]; [vc presentModalViewController:nc animated:YES]; }   #pragma mark - #pragma mark PRIVATE METHODS + (NSMutableDictionary *) keychainSearch:(NSString *)identifier { NSMutableDictionary *keychainSearch = [[[NSMutableDictionary alloc] init] autorelease];   [keychainSearch setObject:kmSSOKeychainGroup forKey:(id)kSecAttrAccessGroup]; // inform the search that we're using the shared keychain [keychainSearch setObject:(id)kSecClassGenericPassword forKey:(id)kSecClass]; // set the type to generic password - other options are certification, internet password, etc   NSData *encodedIdentifier = [identifier dataUsingEncoding:NSUTF8StringEncoding]; [keychainSearch setObject:encodedIdentifier forKey:(id)kSecAttrGeneric]; [keychainSearch setObject:encodedIdentifier forKey:(id)kSecAttrAccount]; [keychainSearch setObject:kAuthenticationServiceName forKey:(id)kSecAttrService];   return keychainSearch; }   + (NSString *) getValueForIdentifier:(NSString *)identifier { NSMutableDictionary *search = [self keychainSearch:identifier];   [search setObject:(id)kSecMatchLimitOne forKey:(id)kSecMatchLimit]; // limit it to the first result [search setObject:(id)kCFBooleanTrue forKey:(id)kSecReturnData]; // return data vs a dictionary of attributes   NSData *value = nil; OSStatus status = SecItemCopyMatching((CFDictionaryRef)search, (CFTypeRef *)&value);   if (status == noErr) { return [NSString stringWithUTF8String:[value bytes]];; }   return nil; }   + (BOOL) setValue:(NSString *)value forIdentifier:(NSString *)identifier {   // check if value exists NSString *existingValue = [self getValueForIdentifier:identifier]; if (existingValue) {   if (![existingValue isEqualToString:value]) { // update value NSMutableDictionary *search = [self keychainSearch:identifier];   NSData *valueData = [value dataUsingEncoding:NSUTF8StringEncoding]; NSMutableDictionary *update = [NSMutableDictionary dictionaryWithObjectsAndKeys:valueData, (id)kSecValueData, nil];   OSStatus status = SecItemUpdate((CFDictionaryRef)search, (CFDictionaryRef)update);   if (status == errSecSuccess) { return YES; } return NO; }   } else {   // create new entry NSMutableDictionary *add = [self keychainSearch:identifier];   NSData *valueData = [value dataUsingEncoding:NSUTF8StringEncoding]; [add setObject:valueData forKey:(id)kSecValueData];   OSStatus status = SecItemAdd((CFDictionaryRef)add,NULL);   if (status == errSecSuccess) { return YES; } return NO;   }   return YES; }   + (void) deleteValueForIdentifier:(NSString *)identifier { NSMutableDictionary *search = [self keychainSearch:identifier]; SecItemDelete((CFDictionaryRef)search); }

   DateUtils:

   + (NSDate *) dateFromString:(NSString *)string withFormat:(NSString *)format { NSDateFormatter *dateFormatter = [[NSDateFormatter alloc] init]; [dateFormatter setDateFormat:format]; NSDate *date = [dateFormatter dateFromString:string]; return date; }   + (NSString *) stringFromDate:(NSDate *)date withFormat:(NSString *)format; { NSDateFormatter *dateFormatter = [[NSDateFormatter alloc] init]; [dateFormatter setDateFormat:format]; NSString *dateString = [dateFormatter stringFromDate:date]; return dateString; }   + (NSDate *) dateWithTimeout:(NSTimeInterval)timeout { NSDate *now = [NSDate date]; NSDate *timeoutDate = [now dateByAddingTimeInterval:timeout]; return timeoutDate; }   + (BOOL) dateInPast:(NSDate *)date { if ([date compare:[NSDate date]] == NSOrderedAscending) { return YES; } return NO; }

2. Within the generated ViewController, add two UILabel outlets/properties – token and expiration date – and a “Logout” button. You’ll need to add two custom methods: logout and a selector to handle the foreground notification we register to receive.

   - (IBAction) logout:(id)sender { [mSSOUtils logout]; [mSSOUtils displayAuthenticateView:self]; }   - (void) enterForeground:(id)sender { // reset labels as we've entered the foreground self.token.text = [mSSOUtils credentialToken]; self.expiration.text = [DateUtils stringFromDate:[mSSOUtils credentialExpirationDate] withFormat:kDateFormat]; }

3. You should only need to update two view lifecycle methods within ViewController – viewDidLoad and viewWillAppear. Within viewDidLoad, we register to receive a notification when the app is brought to the foreground that triggers our UI updates. The additions to viewWillAppear simply update our labels if there is data in the keychain.

   - (void)viewDidLoad { [super viewDidLoad]; // register for enter foreground notification to update labels [[NSNotificationCenter defaultCenter] addObserver:self selector:@selector(enterForeground:) name:UIApplicationWillEnterForegroundNotification object:nil]; } - (void)viewWillAppear:(BOOL)animated { [super viewWillAppear:animated];   self.token.text = [mSSOUtils credentialToken]; self.expiration.text = [DateUtils stringFromDate:[mSSOUtils credentialExpirationDate] withFormat:kDateFormat]; }

4. Add an authenticateViewController to your project. This will be displayed modally when the users credentials need to be re-challenged. This example simply has a login button, but this is where you would include typical login fields.

   - (IBAction) authenticate:(id)sender { // if authentication is successful, dismiss the view if ([mSSOUtils authenticateWithUsername:@"username" andPassword:@"hashedPassword"]) { [self dismissModalViewControllerAnimated:YES]; } }

5. Last up, we’ll need to update our application delegate to confirm our credentials are valid when the app launches or is brought back from the background. You’ll need to update the didFinishLaunchingWithOptions and applicationWillEnterForeground methods as noted below:

   - (BOOL)application:(UIApplication *)application didFinishLaunchingWithOptions:(NSDictionary *)launchOptions { self.window = [[UIWindow alloc] initWithFrame:[[UIScreen mainScreen] bounds]]; // Override point for customization after application launch. self.viewController = [[ViewController alloc] initWithNibName:@"ViewController" bundle:nil]; self.window.rootViewController = self.viewController; [self.window makeKeyAndVisible];   // credentials don't exist or are expired - display the authenticate view if ([mSSOUtils credentialsExpired]) { [mSSOUtils displayAuthenticateView:self.viewController]; }   return YES; } - (void)applicationWillEnterForeground:(UIApplication *)application { // credentials don't exist or are expired - display the authenticate view if ([mSSOUtils credentialsExpired]) { [mSSOUtils displayAuthenticateView:self.viewController]; } }

6. Now, rinse and repeat for App2. You can follow the same steps for the Logout application, but you really just need a single view that calls [mSSOUtils logout] on launch and informs the user their credentials have been terminated.

   - (BOOL)application:(UIApplication *)application didFinishLaunchingWithOptions:(NSDictionary *)launchOptions { self.window = [[UIWindow alloc] initWithFrame:[[UIScreen mainScreen] bounds]]; // Override point for customization after application launch. self.viewController = [[ViewController alloc] initWithNibName:@"ViewController" bundle:nil]; self.window.rootViewController = self.viewController; [self.window makeKeyAndVisible];   // logout to kill credentials [mSSOUtils logout];   return YES; } - (void)applicationWillEnterForeground:(UIApplication *)application { // logout to kill credentials [mSSOUtils logout]; }

Here are a couple helpful hints while developing your solution:

• We’ve disabled ARC for the mSSOUtils class, which means you need to handle memory management yourself.
• When building your application, if you get a Mach-O Linker error, ensure that you’ve added the Security.framework.

Testing

Our testing won’t get too crazy, but at this point you should be all set to install our suite of apps on your device.

We’ll start by opening App1 and simulating an authentication call. Once the modal view is dismissed, our token and expiration date should be updated – expiration being now + 30 minutes. From here, jump to App2 where you should see the App1 token/expiration. Logout and re-authenticate within App2, which will update our token and expiration date. Now, we’ll wait 30 minutes and test whether our token expires. After 30 minutes, open App1, you should be prompted with an authentication view. Authenticate and then open the Logout app. Enter App2 from the multi-task tray, you should be prompted to authenticate once again.

The test sequence above has been captured in the screenshots below. Note: for brevity, I’ve excluded screenshots of each authentication view except for the final step.

Closing

This post presents a pattern for implementing single sign-on for your enterprise iOS applications. It should give you the foundation needed to begin implementing single sign-on in your applications. I’ve attached the source for App1. If you’ve got questions or are interested in additional source files, I’m @nathanhjones on Twitter.

HTML5 has it’s pro’s and con’s that each developer needs to weigh (we won’t get into that here) but web storage and web database are great advances.  The packaged modern mobile browsers (Safari, Android browser, etc) all support the specification which allows applications to store information from within their application that persists from session to session.  It can be very powerful…but it is definitely open for exploitation.  A common example is Gmail which utilizes the storage feature (along with App Cache) to allow you to work within the Gmail web-app while you are not connected to a network.  It also speeds up the entire user experience.

All that being said, I logged into AdWords this evening to begin preparing my campaign for this weekend and noticed they’ve begun utilizing local storage.  The great thing about it is that they request your approval rather than doing it behind the scenes.  Given that any website can create a ‘database’ on your local machine for storing information, I think that all user-agents (think Safari, Firefox, Chrome, etc) should force the user to authorize each use of local storage – i.e. one approval for gmail.com).

In short, it’s really cool that more and more sites are beginning to implement these features as browsers roll-out support but I’m more impressed that AdWords asks for permission.  I think more web-apps should follow the AdWords lead!

Installation

Installation was a breeze.  WPtouch is a WordPress plugin, all it took was downloading the files, uploading it to my server and activating it from the dashboard.  Once activated we were up-and-running with the vanilla install.  Now on to customizing…

Setup

WPtouch offers a wide array of customizing (sorry, this is a word I’ve gotten way too used to in the SAP world) options from enabling AJAX comment posting to custom CSS/Javascript inclusion.  I kept my install fairly simple but there were a couple things I changed.

1. I call myself a developer so I went with a snazzy App Store icon as my mobile banner image (see end of the post). WPtouch has a pretty good selection of images although they’re mostly centered around the iPhone.  If nothing meets your needs you’re more than welcome to upload a custom file.
2. Linking of my AdSense and Analytics accounts.  Must haves…AdSense to collect those occasional pennys and Analytics to obviously to continue to understand how people flow through the site.  Adding both was EXTREMELY easy to do with a custom section for each.

WPtouch gives you the option to display a ‘desktop’ (i.e. non-mobile) version of your website to users on their first visit and include the ability to toggle mobile vs. desktop in your theme footer.  I get the potential draw but if you’re going to go mobile, I’m not sure why you wouldn’t always default mobile and allow them to switch back if they want.

Anyways, you can also change what icon is used for each post and how much information about the post is shown (e.g. just the title, title and a teaser, tags, categories, etc).  I played with the settings a bit but I think that’s really more of a personal choice…at least until I get time to test and study analytic data.

Additions and Suggestions

For a donation supported plugin I can’t really complain.  It’s easy and relatively robust but there are still a couple things I would like to see enhanced:

1. I understand it’s a mobile device and landscape is limited but a second ‘title’ (under NathanHJones.com below) would be ideal.  Obviously, each blog owner would need to be smart about how it was used.
2. Better AdSense rendering.  This may be slightly out of the WPtouch developers hands but I noticed that AdSense ads show up very boxy compared to the smooth WPtouch design.  I don’t know if that’s anything they can fix or perhaps me just being new to AdSense mobile but it didn’t exactly flow together.

If you’re mobile version is powered by WPtouch leave a comment and let me know what you think!  Finally, here’s a fullscreen shot of NathanHJones.com…the mobile version…from my iPhone.

Now, onto the show – I watched the Mark Bittman interview.  I’m not really their target demographic which is why the “set” probably wasn’t what I expected.  I can’t really take it to them for that though, it’s what I would consider a pretty standard set for interview format shows.  Overall, the episode seemed pretty “early stage” to me in that Samantha didn’t feel totally at ease, maybe even a little nervous.  Maybe it was the new setting but some of that may have been Mark who, in my opinion, seemed a bit snarky.  I think he’s earned a little of that right and I still think he’s a very interesting man.  Anyways, I look forward to future episodes as they just off the jitters and I can’t wait to see what kind of guests they can swing.  Knowing the little I do about Gary I’m sure they won’t disappoint.

In closing, I think it’s great idea that has real potential and it’s a bold move into a new demographic for Gary.  I want to see how it plays out but like I said earlier, he’s conquered wine and is making a play to expand his media empire.  For that my friends, you have to respect him.  As Gary would put it, he’s hustlin’ and you can’t get down on someone for that!  Keep up the great work Gary and I look forward to the other stuff you plan on bringing us.

1. IT’S A HUGE BATTERY KILLER!!! I know the TREO 750 already has ‘poor’ battery life according to critics but this drains it faster than Britney Spears bounces in and out of rehab. I can normally get through a full day with moderate email/phone usage but when I’m running Mobile AIM my battery is ready for charging by 11AM – that’s roughly 3.5 hours of use for you bean counters. This has got to be fixed before launching the final version.
2. IT’S A MEMORY HOG!!! I’m not sure if it’s just intense processing or if it’s an actual memory leak but I gained 12MB of memory after shutting down AIM. Gained means it allocated it back to usable memory when I shut it down…it was using 15% (give or take) of my processing power. On a mobile device that’s a HUGE amount of processing power!
3. It doesn’t give external notifications (other than sound which is just obnoxious) when you have a new IM. If you choose to turn on sound it will play the standard new IM sound. However, if your phone is on vibrate it doesn’t do anything to alert you.
4. The interface is visually pleasing and mostly functional, here are a few comments:
   • Good:
     • Navigating between various conversations and your buddy list is extremely easy, especially if you have a touch screen. I think without a touch screen many of the features I enjoy would be difficult
     • You can add/edit/delete groups and friends which is pretty slick for a mobile Beta release
     • You can easily toggle between available, busy and invisible (major plus considering Google Talk hasn’t even got that right in their desktop client yet)
     • Setting messages (away or status – however you use them) is a breeze
   • Bad:
     • There are some issues with how it ‘pages’ when you scroll through your buddy list – it’s a little clunky. This may be attributed to the fact that it’s using so much processing power and the system chokes a little when you try and scroll
     • When you’re in the conversation mode the ‘send’ button is on the wrong side – at least compared to the TREO 750. Text messaging on the TREO is displayed a lot like IM conversations and the send/close buttons are on different sides than AIM Mobile has them. This is big from a usability stand-point – I’ve already had several messages that didn’t get sent because I clicked the wrong button. Just takes getting used to I suppose…
     • There is an ‘alert me when’ option on the menu that I can’t seem to activate. Not sure how it would work given the fact that I don’t get notified of IMs unless I’m physically in the application
5. There isn’t an automatic updater. Not a huge deal but definitely an inconvenience. Now I have to go to the Beta site and download the new version every time they release a fix. They have said an update notification is on it’s way in a future version though. In the mean time it would be nice if the site included dates/times of the most recent release so I could guesstimate whether I should install again. Maybe I’m just missing it because that seems like common sense.

Here are a couple things I’d like to see them add on top of general usability/performance:

1. Add an option to my photo menu to set a particular image as my AIM icon
2. Add an option to my photo menu to send images to AIM buddies if I’m logged in
3. Allow me to add a link to my Windows Today screen that will take me to a new IM if there is one

My current client has blocked AIM/Google Talk so if you’re in the same boat this is definitely worth the download. Here’s a shot of the user interface from the AIM Mobile site.

(image courtesy of AIM Beta site)

It’s a great feature but the default configuration has it suggesting words after the first character which taxes the system (very noticeable delays) and just doesn’t make sense. If I’m typing the word ‘the’, I don’t need the computer to suggest the word for me. I’m pretty sure I’m not that poor of a speller. So, for those of you who have also become frustrated by the ridiculous type-ahead settings here’s a quick fix. Nothing mind boggling…just felt it should be documented.

Fixing:

1. Go to the ‘Start’ menu and enter the Settings
2. Select the Input option (looks like a small keyboard)
3. Choose the ‘Word Completion’ tab at the bottom of the screen
4. You can now turn it off completely or just set it up to only trigger when you really need it. Mine is configured to suggest 4 words after I type 4 letters

Hope this helps someone else out!!

After poking around some of the settings I found that WM6 doesn’t have MSN as the default search engine for the web search feature on the ‘today’ screen.  I know Microsoft has paid penalties out the wazoo for monopolistic practices in it’s PC operating systems so I figured they just didn’t want to get nailed for this and set a different default.  But why Google of all people?!?  At least they tried to purchase of Yahoo…why not set them as the default?!?  After some more searching I was surprised to find that not only is Google the default search engine, it’s the only search engine that you can set.  One of Microsoft’s biggest competitors holds the sole search rights on Windows Mobile devices…weird!

After thinking about it a bit I figured it had to be something that Palm or AT&T configured and it wasn’t Microsoft’s choice.  The thing that bugs me is I don’t even have the option to add a new search engine.  I wonder if AT&T or Palm is getting kickbacks for this nonsense?!?

Then, after reading my blog news a few days ago I heard that Google launched a downloadable plugin for Windows (and here) that allows for ‘fast’ search from the ‘today’ screen of your WM device.  That’s cool, except it already exists and doesn’t require a download.  Not like it takes up much space, but there is just no need.

Now, as many of you are aware I show a lot of love to Google.  I normally approve emphatically of what they do but I just don’t see the point here.

Overall Google, I think it was a waste of time and money to build.  But that’s just me.  Better luck next time.