Integration of Push Notification-Based Transaction Data Signing

Push Notification-based transaction data signing (TDS) is a method to validate transactions. It uses a push mode to enable any activated Mobile Security Suite Orchestration SDK application on a mobile device. This serves to generate a signature for data that is displayed on the mobile device.

For the validation request, a default timeout value of 60 seconds has been defined per tenant. To increase the validation period for Push Notification-based TDS within Intelligent Adaptive Authentication, this timeout value can be increased.

Contact OneSpan Support to extend the timeout configuration for your tenant(s).

Integration for Mobile Security Suite Orchestration SDK

Sequence of a Push Notification-based transaction for Mobile Security Suite Orchestration SDK

1. The user initiates the transaction data signing operation and triggers the client application to send a transaction validation request to the OneSpan Trusted Identity platform API by calling POST /users/{userid@domain}/transactions/validate.

2. The user receives a Push Notification message on their mobile device.

3. The user approves the request to sign the data fields. With this, the transaction data fields have been successfully signed.

Configuration of Push Notification

To use Intelligent Adaptive Authentication with Push Notification, a few configuration steps are required.

To configure Push Notification

1. After configuring your mobile app, you provide the configuration data to OneSpan. This data includes:

   • Android: the API keys and/(or certificates for Firebase Cloud Messaging (FCM)

   • iOS: the certificates and the Bundle ID

   You need to generate all the required certificates and provide them to OneSpan. For information how to generate these certificates, refer to the Apple and Android developer documentation.

2. Intelligent Adaptive Authentication uses this data and creates the configuration in the Intelligent Adaptive Authentication database. The data is stored under a key referred to as app ID.

3. The app ID must be set as the name of the mobile app (Mobile Application Name) in your Authentication component domain.

4. Send a Push Notification. When sending, Intelligent Adaptive Authentication uses the app ID that was configured in the domain to retrieve the necessary configuration data. This data is used to contact Google Firebase Cloud Messaging (Android) and APNs (iOS).

   For Android, the pairing to the ID of the Android application happens exclusively inside the PNS configuration of your Firebase Cloud Messaging account to which you provided the credentials.

   iOS: the Bundle ID must be provided to Apple for each request. If the iOS Bundle ID is missing in the mobile app configuration, the app ID configured in the Authentication component is used as Bundle ID.

   Once the Push Notification is sent to Google FCM/iOS APNs, the notification delivery to the mobile device (the user) is handled by these services, i.e., the notification is not controlled by Intelligent Adaptive Authentication.

To integrate Push Notification-based transactions for Mobile Security Suite Orchestration SDK

• Issue a transaction request with the POST /users/{userid@domain}/transactions/validate endpoint:

  • Payload:

    • objectType: "Adaptive TransactionValidationInput"

    • data.transactionMessage

    • orchestrationDelivery

      • pushNotification