# Securing IS webservices for Mobiles **URL:** \ **Category:** Forum\ **Tags:** mobile\ **Created:** [February 28, 2012, 8:52am UTC](https://techcommunity.softwareag.com/t/securing-is-webservices-for-mobiles/100398 "2012-02-28T08:52:27Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![system](https://global.discourse-cdn.com/techcommunity/original/3X/c/d/cd19967bb605d28a72d77eb83a1cae22f3df2eb8.svg) [@system](https://techcommunity.softwareag.com/u/system)\ **Post date:** [February 28, 2012, 8:52am UTC](https://techcommunity.softwareag.com/t/securing-is-webservices-for-mobiles/100398/1 "2012-02-28T08:52:27Z")
Hi All, We have an application in MWS that is hosted on IIS through an iFrame that provides a customer with some account information. A company has created an iPhone application that pretty much takes the users credentials, from the iPhone, and passes it via the application developers site through to the IIS iFrame path /my/App/Path/?username=&password=. It then scrapes the response and passes it back to the iPhone in a JSON format. The architecture we have is: IIS on https (DMZ) ← ARR → MWS (8.0.2) on https ← WS → IS (8.0.2) \<-\> DB ``` ^ ``` | V ``` OpenLDAP for authentication ``` My questions to the experts are as follows: 1. If we are to have a mobile application that is on iTunes/Android Market (publicly available), how can we secure the IS layer to avoid someone generating applications that aren’t official to use the webservice? 2. Do we have support for 2/3 legged OAuth on the IS layer? 3. Maybe generate some registration process for the installation of the application to capture device specific details and add it to some sort of white list? Almost like a banking application where you verify by sending sms with a code Now we can easily install certificates on IS and set up another in the DMZ with remote invoke capabilities, but it’s to just protect against someone decompiling the application and working out the WS endpoint URL. Any help/pointers on how best to proceed would be much appreciated; even if we have some documentation on best practices would be handy. Regards, Aditya Gollakota Integration Consultant | Software AG | [www.softwareag.com](http://www.softwareag.com/) M: +61 405 033 951 | E: [aditya.gollakota@softwareag.com](mailto:aditya.gollakota@softwareag.com) ContactCard ---
**Author:** ![nugonotti](https://avatars.discourse-cdn.com/v4/letter/n/8baadc/32.png) [@nugonotti](https://techcommunity.softwareag.com/u/nugonotti)\ **Post date:** [February 28, 2012, 9:02am UTC](https://techcommunity.softwareag.com/t/securing-is-webservices-for-mobiles/100398/2 "2012-02-28T09:02:09Z")
Aditya, A Policy Gateway or Policy Enforcement Point (Layer 7 SecureSpan) could help in this scenario as we can use the transport to check application type/name, session details, etc. for the service consumer and attempt to put some smarts around the caller after they have authenticated to some IDMS prior to calling the service end point. Thanks & Regards, Nino Ugonotti From: Gollakota, Aditya Sent: Tuesday, 28 February 2012 2:22 PM To: Ask\_Mobile\_Community; RnD-wM-Security-SWAT; Ugonotti, Nino Cc: Ask\_wM\_ProfessionalServices; Ask\_wM\_GlobalServices Subject: Securing IS webservices for Mobiles Importance: High Hi All, We have an application in MWS that is hosted on IIS through an iFrame that provides a customer with some account information. A company has created an iPhone application that pretty much takes the users credentials, from the iPhone, and passes it via the application developers site through to the IIS iFrame path /my/App/Path/?username=&password=. It then scrapes the response and passes it back to the iPhone in a JSON format. The architecture we have is: IIS on https (DMZ) ← ARR → MWS (8.0.2) on https ← WS → IS (8.0.2) \<-\> DB ``` ^ ``` | V ``` OpenLDAP for authentication ``` My questions to the experts are as follows: 1. If we are to have a mobile application that is on iTunes/Android Market (publicly available), how can we secure the IS layer to avoid someone generating applications that aren’t official to use the webservice? 2. Do we have support for 2/3 legged OAuth on the IS layer? 3. Maybe generate some registration process for the installation of the application to capture device specific details and add it to some sort of white list? Almost like a banking application where you verify by sending sms with a code Now we can easily install certificates on IS and set up another in the DMZ with remote invoke capabilities, but it’s to just protect against someone decompiling the application and working out the WS endpoint URL. Any help/pointers on how best to proceed would be much appreciated; even if we have some documentation on best practices would be handy. Regards, Aditya Gollakota Integration Consultant | Software AG | [www.softwareag.com](http://www.softwareag.com/) M: +61 405 033 951 | E: [aditya.gollakota@softwareag.com](mailto:aditya.gollakota@softwareag.com) ContactCard ---
**Author:** ![Christoph\_Jahn](https://sea1.discourse-cdn.com/techcommunity/user_avatar/techcommunity.softwareag.com/christoph_jahn/32/176_2.png) [@Christoph\_Jahn](https://techcommunity.softwareag.com/u/Christoph_Jahn)\ **Post date:** [February 28, 2012, 9:58am UTC](https://techcommunity.softwareag.com/t/securing-is-webservices-for-mobiles/100398/3 "2012-02-28T09:58:37Z")
Also, Apple allows companies to have non-public app stores. For that kind of application this is definitely the way to go. ---
**Author:** ![Sachin1](https://avatars.discourse-cdn.com/v4/letter/s/aca169/32.png) [@Sachin1](https://techcommunity.softwareag.com/u/Sachin1)\ **Post date:** [September 1, 2012, 5:15am UTC](https://techcommunity.softwareag.com/t/securing-is-webservices-for-mobiles/100398/4 "2012-09-01T05:15:16Z")
Hi Aditya, We are introducing a new product called “wM Mobile Gateway” to solve the problem you have. It will be part of webMethods 9.0. Regards, Sachin ---
**Author:** ![system](https://global.discourse-cdn.com/techcommunity/original/3X/c/d/cd19967bb605d28a72d77eb83a1cae22f3df2eb8.svg) [@system](https://techcommunity.softwareag.com/u/system)\ **Post date:** [April 2, 2021, 3:01pm UTC](https://techcommunity.softwareag.com/t/securing-is-webservices-for-mobiles/100398/5 "2021-04-02T15:01:54Z")