A Wizard-based Approach for Secure Code Generation of Single Sign-On and Access Delegation Solutions for Mobile Native Apps

摘要: Many available mobile applications (apps) have poorly implemented Single Sign-On and Access Delegation solutions leading to serious security issues. This could be caused by inexperienced developers who prioritize the implementation of core functionalities and/or misunderstand critical parts. The situation is even worse in complex API scenarios where app interacts with several providers. To address these problems, we propose a novel wizard-based approach that guides integrate multiple third-party Identity Management (IdM) providers their apps, (i) “enforcing” usage best practices for native (ii) avoiding need download SDKs understanding online documentations (a list known IdM configuration information embedded within our approach), (iii) automatically generating code enable communication different effectiveness proposed has been assessed implementing an Android Studio plugin using it providers, such as OKTA, Auth0, Microsoft, Google.