11 Mobile Single Sign-On

11.1.1 Oracle Application Server Wireless Concepts and Architecture

Wireless products communicate with Oracle Application Server using either wireless markup language (WML) or HTML. Cellular phones use WML; PDAs use HTML. Because these devices request URLs using Wireless Access Protocol (WAP) and other non-HTTP protocols, hardware gateways must be used to convert messages to (and from) HTTP.

The heart of OracleAS Wireless is the Wireless and Voice Portal. It serves as a browser for interactions between the wireless device and the SSO server and for interactions between the wireless device and Oracle applications. The Wireless and Voice Portal server performs the following functions:

• It authenticates the user directly to the SSO server.

• It serves private pages of its own.

• It serves as a proxy browser for external, SSO-protected applications by passing requests to these applications, which then perform SSO authentication.

• It converts Oracle Application Server Wireless XML to the appropriate device markup language (either WML or HTML).

In the Wireless and Voice Portal framework, external applications are partner applications that are integrated with the Oracle Application Server SSO Software Development Kit (SDK). The Wireless and Voice Portal treats these applications as public applications even if they are not. A Wireless and Voice Portal instance uses an HTTP adapter to serve as a proxy browser for such applications.

11.2.1 Authenticating Through the Wireless and Voice Portal

The mobile user authenticates from the Wireless and Voice Portal public page either by requesting a private application or by an explicit login request (identified by the URL parameter, PAlogin=true) to the SSO server.

Figure 11-1 Interactions Between Oracle Application Server Wireless and the Login Server

Description of "Figure 11-1 Interactions Between Oracle Application Server Wireless and the Login Server"

Figure 11-1 depicts the events from the login request to the application result returned to the user as follows:

1. The mobile user accesses the OracleAS Wireless and Voice Portal by entering a URL of the following form:

   http://<host>:<port>/ptg/rm

   The Wireless and Voice Portal public page appears, displaying links for public and private Wireless and Voice Portal applications.

2. The user requests a private application or selects the key icon that invokes the SSO page. (Figure 11-2 depicts the portion of this page where users enter their names.)

3. The SSO server searches for the encrypted SSO cookie. If the cookie is present, then the server uses it to identify the user. The server then sends the single sign-on redirect form (Step 7). This occurs if the user is already authenticated by an external partner application (Section 11.2.2). If the cookie is not present, then server sends the OracleAS Wireless XML login form to Wireless and Voice Portal.

4. Wireless and Voice Portal transforms the OracleAS Wireless XML login form to the appropriate markup language and sends the converted form to the device browser.

5. The user submits the login form with the user name and password.

6. The Wireless and Voice Portal forwards the login form to the SSO server.

7. The SSO server authenticates the user. If authentication succeeds, then the server sends the Wireless and Voice Portal the SSO redirect form. If the authentication fails, then the SSO server sends a login form (Step 3).

8. The Wireless and Voice Portal sends the user the home page or the requested URL.

Figure 11-2 The Wireless Single Sign-On Page: the User Name Field

Description of "Figure 11-2 The Wireless Single Sign-On Page: the User Name Field "

11.2.2 Authenticating by Requesting a Partner Application

Using the mobile device, the user may also authenticate to the SSO server by requesting URLs for other partner applications. In this case, the authentication redirection agent is not the Wireless and Voice Portal, but an application integrated with the single sign-on SDK.

The first request to the OracleAS Wireless and Voice Portal (http://<server>:<port>/ptg/rm) returns the home page of the anonymous user (a guest user), or the home page of the identified virtual user.

From that point, the user can access public (unsecure) applications or can explicitly log in to the secure applications, which are assigned to that user. The unauthenticated user can execute HTTP Adapter-based public applications, which point to an SSO-based partner application (such as Oracle Portal). The partner application may complete the SSO-based user authentication.

Figure 11-3 illustrates the authentication sequence:

Figure 11-3 Authenticating by Requesting a Partner Application

Description of "Figure 11-3 Authenticating by Requesting a Partner Application"

The authentication sequence (as depicted in Figure 11-3) is as follows:

1. An unauthenticated user requests a partner application.

2. The Wireless and Voice Portal sends the request to the partner application, using an HTTP adapter situated on its back end.

3. If the URL requested is protected, then the partner application issues an HTTP redirect to the SSO server.

4. The Wireless and Voice Portal follows the redirected URL.

5. The SSO server looks for the encrypted SSO cookie, which is set in the Wireless and Voice Portal browser. If the cookie is present, then the server uses it to identify the user. The server then sends the SSO redirect form (Step 9). If the cookie is not present, then the server sends the mobile XML login form to Wireless and Voice Portal.

6. The Wireless and Voice Portal converts the OracleAS Wireless XML login form to the appropriate markup language and delivers the converted form to the device browser.

7. The user submits the login form with the user name and password.

8. The Wireless and Voice Portal passes the login request to the SSO server.

9. Upon successful authentication, the SSO server sends a redirect form that points to the partner application.

10. Wireless and Voice Portal follows the redirect form. At this point, the Wireless and Voice Portal, knowing that authentication has been successful, updates the user's session.

11. The partner application serves content in OracleAS Wireless XML.

12. The Wireless and Voice Portal converts the OracleAS Wireless XML content to the appropriate markup language and delivers the converted content to the device browser.

11.2.3 Authenticating by mod_osso

The OracleAS Wireless Tools, which are used by developers and administrators, as well as those intended for end-users (such as the OracleAS Wireless Customization Portal), authenticate users with mod_osso, which is a module plugged into Oracle HTTP Server. All of the Web-based OracleAS Wireless applications running behind the Oracle HTTP Server are treated as a single partner application. Users can access the applications appropriate to their roles and privileges after single sign-on.

The Wireless and Voice Portal uses the value of the HTTP header OssoUser_Guid to identify the mod_osso-authenticated user.

11.2.4 Authenticating Through Voice

Voice authentication is accomplished by OracleAS Wireless locally using the account number and the PIN of the user.

11.3.1 Logging Out from Oracle Application Server Wireless

The user clicks OracleAS Wireless Logout to sign off.

1. The user sends a an OracleAS Wireless Logout request (identified by URL parameter PAlogoff=true).

2. The Sign Off implementation of OracleAS Wireless sends an HTTP request to the SSO Sign-Off URL.

3. The SSO server returns the OracleAS Wireless XML global logout page and a special HTTP header (X-Oracle-SSO-logout with value = true). The global logout page contains one image for each partner application that has the user session.

4. OracleAS Wireless sends HTTP requests to each image link. This is done so that the user's session gets cleaned up in all the partner applications.

5. OracleAS Wireless terminates the user's session.

6. If Logout is accomplished through OracleAS Wireless link, then the home page of the guest user is returned.

11.3.2 Logging Out from a Partner Application

The authenticated user clicks the logout link on the page returned by the SSO-based partner application. In this case, the logout link points to the SSO sign-off URL.

1. The user clicks on the logout link which points to the SSO sign-off URL.

2. The SSO server returns the OracleAS Wireless XML global logout page and a special HTTP header (X-Oracle-SSO-logout with value = true). The global logout page includes one image for each partner application which was active in user session.

3. OracleAS Wireless sends HTTP requests to each image link to clean up the user's session in all the partner applications.

4. OracleAS Wireless terminates the user's session.

5. OracleAS Wireless returns the user's home page if the user has logged in through the OracleAS Wireless and Voice portal. OracleAS Wireless returns the done_URL of the global logout page if the user logged in by requesting a partner application.

11.3.3 Logging Out from a Web-Based Oracle Application Server Application

Since all Web-based Oracle Application Server applications are authenticated through mod_osso, and are treated as a single partner application, logout from any application triggers global sign-off . The user cannot access any of the applications until the user signs on through mod_osso again.