Authentication Providers for User Authentication and Authorization

A security profiles verifies the identities of application users and administrators who request access via one or more configured authentication provider. SAP Mobile Platform Server supports a variety of built-in authentication providers that authenticate users. Administrators create a security profile and assign one or more providers to it using Management Cockpit.

You can configure a provider of a given type only if that provider is available on the enterprise network.

Administrator authentication and device user authentication are configured differently:

• Administrators are authenticated with the Admin security profile. For first-time logins, administrators are authenticated with the System Login (Admin Only) authentication provider. Once logged in, administrators for production systems should immediately reconfigure the Admin security profile to use the enterprise security back end using Management Cockpit.
• Device users are authenticated with custom SAP Mobile Platform Server security profiles created by the platform administrator in Management Cockpit. For SAP back ends, SSO authentication can be configured.

• No Authentication Challenge Provider
  The No Authentication Challenge provider offers pass-through security for SAP Mobile Platform Server, and is intended for use in development environments or for deployments that require no security control. Do not use this provider in production environments, for administration, or for device user authentication.
• System Login (Admin Only) Provider
  This provider is intended only to bootstrap the Admin security profile after a new installation. It is not appropriate for production use.
• Populate JAAS Subject From Client Provider
  This provider is used to copy HTTP header and cookie values from the client request into the authenticated JAAS subject as user Principals (which identifies who the client user is), roles (which determines the permissions the user may have), and credentials (which provide single sign-on material for back-end systems).
• X.509 User Certificate Provider
  Use X.509 User Certificate when the client has authenticated using HTTPS and X.509 certificates for mutual authentication.
• HTTP/HTTPS Authentication Provider
  Use the HTTP/HTTPS Authentication provider to authenticate the user with a call to a separate Web server to validate the user's credentials. It is useful to validate user name and password basic credentials, or to validate a single sign-on token from the client (in lieu of passwords).
• Directory Service (LDAP/AD) Provider
  Add an LDAP provider to a security profile to authenticate administrator logins (on the Admin security profile) or device user logins (any custom security profile for that purpose).
• UserRoleAuthorizer Provider
  The UserRoleAuthorizer provider grants logical roles to specific users when the user's roles cannot be retrieved by the configured authentication provider from the back end. You cannot manually configure this provider.
• controlFlag Attribute Values
  The SAP implementation uses the same control flag (controlFlag) attribute values and definitions as those defined in the JAAS specification.