OpenEdge Development: Mobile Applications - Product ...

Chapter 1: OpenEdge Mobile Overview
Access to Mobile services with user login sessions
In Figure 3, it is the JSDO catalog for the OrderEntry service that ultimately enables
JavaScript methods of the Customers JSDO to execute ABL methods of the
Customers class to implement operations of the Customers resource. Before it can
create and use a JSDO to access a Mobile resource, an OpenEdge Mobile App must
log into the appropriate Mobile Web application and load the catalog file for the Mobile
service that provides the resource.
Depending on the Web server and Mobile Web application security configuration, the
Mobile App can log into the Web application as directed by the Web server, native
device container, or browser, or by using the login( ) method of the OpenEdge
JavaScript class, progress.data.Session. If the Mobile App login successfully
occurs before calling this login( ) method, the Mobile App must still call the method
in order to establish the login session with the Mobile Web application and load its
JSDO catalog files.
To use a Session object to establish the login session, the Mobile App creates an
instance of the class and invokes the login( ) method on that instance, passing the
Mobile Web application URI and optional user credentials as parameters. The exact
user login sequence can be affected by the Web server security configuration, the
Mobile App type, design, and platform, and how Mobile Web application resources are
protected on the Web server. For example, if the required user credentials have
already been authenticated prior to calling this method, any user credentials you pass
to the method are ignored. For more information on establishing a login session for a
Mobile App, see Chapter 4, “Creating Mobile Apps using JSDOs.”
Loading the JSDO catalog
Once the login( ) method on a Session object has been successfully called for a
given OpenEdge Mobile Web application, the Mobile App can then call the
addCatalog( ) method on the Session object to load the JSDO catalog for each
Mobile service in the Mobile Web application it needs to access. Each JSDO catalog
has a URI that you pass to this method, along with optional user credentials if the
catalog requires separate user authentication. Note that by default the filename for a
JSDO catalog has the name of the Mobile service for which the catalog is created.
Therefore, its filename and extension have the form, service-name.json. Once a login
session is successfully established, and all required JSDO catalogs are loaded, the
Mobile App can invoke operations for all authorized Mobile services and resources.
Note that Mobile services and resources in a Mobile Web application are protected
using the Spring Security framework, which is installed with OpenEdge to secure
Mobile and REST Web applications. For more information on using Spring Security to
secure Mobile or REST Web applications, see the sections on managing REST
application security in OpenEdge Application Server: Administration.
Single sign-on to the AppServer
OpenEdge also supports single sign-on (SSO) to the AppServer for a user login
session, depending on the OpenEdge Mobile Web application security configuration.
When appropriately configured, and after a Mobile Web application authenticates a
login session, the application creates an SSO client-principal that it sends to the
AppServer with each AppServer request generated by a JSDO. This client-principal
contains the user ID used to login a Mobile App and a unique session ID. The
AppServer can then access this client-principal using the CURRENT-REQUEST-INFO
attribute on the SESSION system handle and use it to establish an SSO login session
for the current request.
40 OpenEdge ® Development: Mobile Applications