Search code examples
ibm-mobilefirstmobilefirst-adaptersmobilefirst-server

IBM MobileFirst Adapter based authentication in hybrid apps. Server sends UserIdentity object to client

Sample taken from here: https://github.com/MobileFirst-Platform-Developer-Center/AdapterBasedAuth

mfp -v: 7.1.0.00.20151219-1541

When authentication succedes I get this response enter image description here

As you can see server sends UserIdentity object to client.

My UserIdentity object stores additional ID keys that I get from backend and use to access backend through adapters. When WL server recognizes user, I can get those keys from UserIdentity (WL.Server.getActiveUser), and go to backend for data. I need those keys to stay on WL server.

How can I stop server sending UserIdentity object.

Solution

  • I've got PMR response to this problem.

    The behaviour described in the PMR is the expected one. The only way to avoid this is not saving the private data in the UserIdentity properties. The UserIdentity is meant to be shared between client and server.

    Alternatively, you can save the sensitive data in a database using the clientId variable. You can find an example on how to do so in the Two-Step adapter authentication tutorial.

    You can open a feature request but notice that this behaviour is by design.

    So the question is closed