Breeze Login

How we built Breeze Login in the Dreamforce Mobile App

Transcript

1. BREEZE LOGIN
2. BREEZE ENABLES TWO FACTOR AUTHENTICATION BY COMBINING SOMETHING YOU KNOW WITH SOMETHING YOU HAVE
3. IS THIS SOMETHING NEW?
4. WHAT MAKES UP BREEZE? > A mobile application > Salesforce MobileSDK > OAuth Connected Apps on Salesforce > A simple API to look up the user and send emails
5. SHOW ME A PICTURE, PLEASE!
6. THE FLOW
7. THE MOBILE APPLICATION
8. USER FLOW
9. EMAIL AND TOKEN API
10. HANDLE THE REQUEST AND LOOKUP THE USER @HttpGet global static void getBreezeLogin() { RestRequest req = RestContext.request; String regName = req.params.get(EVENTREGNAME_PARAM); String lastname = req.params.get(LASTNAME_PARAM); User user = BreezeService.findUser(regName, lastName) if (user != null){ BreezeService.createTokenAndSendEmail(user) createResponse(OK, user) } else { createResponse(NOT_FOUND, user) } }
11. CREATE THE TOKEN public static String createToken(String userName, Integer validFor) { JWT jwt = new JWT('RS256'); jwt.cert = 'Name Of Cert'; jwt.iss = 'Connected App Client Id'; jwt.sub = userName; jwt.aud = 'success.salesforce.com'; return jwt.issue(); }
12. SEND THE USER AN EMAIL public static void createTokenAndSendEmail(User user){ String jwtToken = createToken(user.UserName); Messaging.SingleEmailMessage message = createEmail(jwtToken) Messaging.sendEmail(message); }
13. CONNECTED APP
14. CREATING A CERTIFICATE > "Setup -> Security Console -> Certificate and Key Management" > Self-Signed > Exportable > 2048 bits > Download Certificate file
15. CONFIGURE CONNECTED APP
16. SECURITY CONSIDERATIONS > User's must include the Last Name of that matches the Registration Id. > Email in response is obfuscated > JWT is only valid for 30 minutes
17. THE MOBILE APPLICATION
18. USER GETS AN EMAIL' > The mobile client should open up our App when the user clicks that link via Deep Linking https:// success.salesforce.com/ breezeLogin?jwt=XXXX > Universal links (iOS)/App Links (Android) associate normal web urls with applications > But there are some edge cases
19. CATCHING THE EDGE CASES > Users fall back to opening the url in a web browser > Page has a button to manually launch the app > eventsbreeze://breezeLogin? jwt=XXXX
20. PARSING JWT AND AUTHENTICATING WITH SDK // https://success.salesforce.com/breezeLogin?jwt=XXXX // eventsbreeze://breezeLogin?jwt=XXXX public void parseJwtAndAuthenticate() { String jwt = getIntent().getData().getQueryParameter("jwt"); UserAccountManager accManager = SalesforceSDKManager.getInstance() .getUserAccountManager(); accManager.switchToNewUser(jwt, "https://success.salesforce.com"); }
21. JWT EXCHANGED FOR ACCESS TOKEN > Given the JWT the MobileSDK gets an access and refresh token > The mobile application is then given a fully fledged User object once this completes from the MobileSDK
22. WHAT WE SAW
23. BREEZE LOGIN > Convenient solution for users entering passwords > Two-factor authentication > Easy to implement on the Salesforce platform > Adaptable for any mobile application
24. QUESTIONS? > Links http://bit.ly/breezelogin