How to do authorization for mobile cloud app in IBM Bluemix

Question

There are multiple tutorials about authentication in Bluemix, but I yet to find a good tutorial about authorization. In my mobile app, I need to group users and only users with a group get to see the messages allowed to this group. Is there a service can help to implement this?

Someone mentioned Stormpath in the forum, it has built in features for user registry, login, authorization etc, which is what I need. Does it work with mobile app? is it free to use with Bluemix? It has tutorial to integrate with node.js, assume that works with Bluemix?

Thanks.

Zheng

Answer 1

Use Bluemix Push Notifications service. This service manages the mapping of your application users to their devices, device platform, and handles dispatching push notifications to them. With this service, you can send broadcasts, unicasts (based on userID, deviceID), and also tags (or topics) based on push notifications to your mobile application users.

Answer 2

Stormpath is not an IBM product and comes with its own pricing (read: not free). And yes the node.js tutorial would work.

You could use the business rules service in Bluemix to determine authorisation. While it is more effort (you still need to query a store where groups and roles are kept, eg LDAP) it allows most flexibility. Instead of asking "is the user member of group xxx" you ask "is this user authorized" and let the business rule figure that out.

Answer 3

The Stormpath API has been deprecated, so if you are using it you'll need to migrate by August 17th 2017 .

There are currently a few options in the Bluemix catalog.

Passport is a third party option that is similar to Stormpath but also has some additional user management features. IBM is offering App ID , but I believe this is only offering social authentication and then service authorization. If you don't want social login, you'd have to bring your own Identity Provider.

I am not aware of any free offerings in the Bluemix catalog.