Background
Building a mobile App for product X which is currently hosted as a SaaS solution. The product X does not support OAuth currently, implements basic authentication and generates Session token after authentication. Product X also implements SSO supporting native SAML 2.0.
Use Case
Mobile App also implements SSO using existing SSO framework. In this mobile app calls SSO URL and on authentication IDP redirects back to SaaS application, which on receiving SAML token issues session token which is passed to mobile app. Then mobile app calls Product X APIs (hosted along with SaaS application) using session token
Problem
As per organisation security recommendation session token storage on mobile is not secure. They recommend OAuth/JWT tokens.
Probable Solutions
- Product X implements OAuth - which is not feasible in given time frame
- AWS Cognito as federated cloud proxy - Did some research on this, found that this is used to facilitate authentication for AWS services
Any recommendations?
- For storing session token on mobile app securely. Which can be used to convince security team
- For using any other federated cloud proxy to get OAuth/JWT tokens