THE IBM CLOUD is a great place to create secure applications and for a while now, the App ID service has been available to help developers easily add authentication into both web and mobile apps. There are lots of reasons why authentication is useful, for example it allows an app to store user preferences or histories but it also potentially allows access to secured data.
The service also works with a number of identity providers – Social identity providers, namely Facebook and Google as well as Enterprise identity providers which means a corporate directory that supports SAML, such as Active Directory Federation Services (ADFS).
That’s great for authenticating users but what about authenticating other apps so that they are authorised?
Well, this week, the ability to carry out app-to-app authorisation was GA’d into App ID.
This means that authorised applications can now access your apps, without user intervention – this might be useful where another application needs to access your app to carry out it’s work but you want to be sure that application is ‘who’ it says it is.
The process uses OAuth2.0 capabilities to exchange tokens between the applications. Once an app is registered, it obtains a client ID and a secret and in turn, these can be exchanged for a token that allows access to a protected app.
So, if you’re looking for a way to easily add app-to-app security to your IBM Cloud deployment, check out the new App ID features. For more information about this new feature, check out the this page in the documentation or for more about App ID in general, including a Getting Started tutorial, look here.