IBM Developer

Tutorial

Secure an Android mobile application with IBM Security Verify SaaS

Integrate an Android mobile app with IBM Security Verify SaaS for enhanced authentication and personalized user experiences

By Sushmita Das, Honey Gidwani

On this page

Security stands as a cornerstone in consumer-facing applications, whether web or mobile. Any compromise not only risks losing customers but also impacts revenue and brand reputation. It is important to not only prioritize security but also ensure a seamless user experience, avoiding user annoyance during application use.

In this tutorial, learn how IBM Security Verify SaaS can effectively address both security and user experience concerns, providing an enriching and secure end-user journey.

User journeys, including registration, authentication via social providers such as Google/Facebook, risk-based advanced authentication, and profile/password management, are intrinsic capabilities of IBM Security Verify SaaS. Additionally, multi-factor authentication (MFA) using SMS/Voice OTP and logout functionalities further fortify the platform’s security, catering to both web and mobile applications.

Leverage the REST APIs of IBM Security Verify SaaS to create highly customizable and personalized user experiences. Alternatively, you can also use the default Verify IAM pages with the mobile application to deliver a seamless experience to end-users.

IBM Security Verify SaaS offers various authentication options, as shown in the figure below, enabling consumers to use their social identities (e.g., LinkedIn, Facebook, or Google) for login or to create a new account if they prefer not to use social options. Additionally, IBM Security Verify SaaS ensures compatibility with any SAML or OIDC compliant identity provider, providing enterprises with flexibility in authentication methods.

Authentication methods Figure: Authentication methods in IBM Security Verify SaaS

The following figure shows the adaptive access capability of IBM Security Verify SaaS. To mitigate the risk of fraudulent access to the consumer application, organizations can establish access policies. These policies dynamically regulate access, blocking users with elevated risk profiles from accessing sensitive resources.

Risk-based adaptive access Figure:Risk-based adaptive access capability of IBM Security Verify SaaS

Learning objectives

In this tutorial, you will learn a step-by-step method for seamless integration of an Android mobile application with IBM Security Verify SaaS. It covers authentication, authorization, multi-factor authentication (MFA), risk-based adaptive access, and other essential aspects of IAM tailored for the consumer space.

User registration and authentication process overview

A high-level overview of user registration and authentication process using IBM Security Verify SaaS follows:

  • The mobile application enables users to create an account with the customer brand and authenticate either through their registered account credentials or via social identity providers such as Google or Facebook.

  • The registration process uses Verify REST APIs to onboard customers. Alternatively, users can opt for Out-of-Band (OOB) registration forms provided by IBM Security Verify SaaS.

  • If users choose to authenticate using social identities, they are automatically onboarded into IBM Security Verify SaaS upon successful authentication.

  • Users have the ability to manage their profiles, passwords, delete their accounts, update their usernames, and enable Multi-Factor Authentication (MFA) using Email or Phone OTP.

  • Upon logout, their session is cleared, requiring re-authentication to access app services.

Enhancing user authentication in the mobile application

The following image shows the mobile application's landing page:

App Landing Page

In addition to traditional username and password authentication, users can use alternative methods such as biometrics and PIN for logging into the mobile app.

App Login

Biometric authentication

For biometric authentication, the mobile application uses the biometrics enabled on the user's device. After verifying the biometrics, the mobile application generates an access token based on the refresh token obtained during the initial authentication with user credentials. The lifetime of the token is customizable within IBM Security Verify SaaS.

PIN authentication

To authenticate using a PIN, users must first set a PIN during a validated session from the profile page. Once set, they can subsequently use the same PIN for authentication. Similar to biometrics, the app uses the access token mechanism to authenticate the user via IBM Security Verify SaaS.

This tutorial provides step-by-step instructions on how to enhance mobile application security using IBM Security Verify SaaS and IBM Security Verify REST APIs.

Prerequisites

  • Get a IBM Security Verify SaaS tenant. Register for a free IBM Security Verify SaaS trial.

  • To run this mobile application locally, ensure that you have set up Android on your desktop.

Steps

Step 1. Clone the repository

Download the ZIP file from GitHub to your local machine and extract its contents. Then, open a command prompt to install the project dependencies.

Step 2. Register a Sample Application

  1. Login to your tenant and navigate to Applications -> Add Application.

  2. Select Custom Application and proceed.

  3. In the Sign-on tab, choose the type as Open ID Connect 1.0.

  4. Provide the application URL as http://localhost:8081 and the redirect URI as http://localhost:8081.

  5. Select Authorization code as the grant type with PKCE option checked, and then create the application.

  6. Choose specific identity providers such as Google, Facebook, and Cloud Directory.

  7. Under the Entitlements tab, select the first radio button for Automatic access for all users and groups.

  8. Save your settings.

    Register sample app

Step 3. Update tenant details

Modify the .env file to include the tenant name, client ID, and client secret of the registered application.

Update tenant details

Step 4. Configure identity providers

  1. Ensure the Primary Identity Source is set to Cloud Directory.

  2. Create identity sources for Google and Facebook.

  3. Google

    Google serves as an example Social Sign-On provider integrated with the demonstration application via IBM Security Verify SaaS. You'll need a Google account to register your IBM Security Verify SaaS tenant as an application.

    Note: When creating the application definition on Google, ensure to enable the People API to avoid errors during single sign-on.

  4. Facebook

    Facebook is another example Social Sign-On provider integrated with the demonstration application via IBM Security Verify SaaS. You'll require a Facebook account to register your IBM Cloud Identity tenant as an application.

    To create identity sources for Google and Facebook, follow these steps:

    1. Ensure you have accounts for these services and application definitions for Cloud Identity.
    2. Provide redirect URIs, available in the IBM Security Verify SaaS Console (along with links to the developer consoles for these services).
    3. Specify the following settings for Identity Linking:
      • Enabled: On

  5. Unique User Identifier: email

  6. Just-in-time Provisioning: On

    Note: Enabling Identity Linking is optional.

    After saving each Identity Source, revisit the properties and make a note of the Identity Source ID. This is necessary when updating the Cloud Identity template pages.

Step 5. HTML files customization

The HTML files required for customization are located in the GitHub repository. You can modify the registration, login, and other Verify pages to align with your brand's aesthetics. Alternatively, you can use the default template provided by IBM Security Verify SaaS for the user interface (UI).

Step 6. Executing the code

  1. Navigate to the directory where the updated code is located.

  2. Run the following command to start the Android mobile application

    Run the code

Securing an Android mobile application demo

Watch the following demonstration to learn how to integrate an Android mobile application with IBM Security Verify SaaS:

Summary

Use to the code provided in the GitHub repository as a reference to develop your first CIAM mobile application. Customize the pages to reflect the visual identity of your brand. Design intricate user journeys by harnessing the capabilities of Verify REST APIs, ensuring a tailored and personalized brand experience.

Next steps

  • Explore our product documentation, which provides comprehensive insights into IBM Security Verify.
  • Access our step-by-step guide to seamlessly integrate social IDPs.
  • Check out instructions about UI branding and customization to tailor the interface to your brand's identity.