Blog | G5 Cyber Security

BlackBerry Web Service Authentication

G5 Cyber Security

TL;DR

This guide helps you get a BlackBerry client successfully authenticating to your Java web service. We’ll cover common issues and solutions, focusing on SSL/TLS configuration and proper request formatting.

1. Understand the Authentication Method

BlackBerry devices typically use Basic Authentication or Token-based authentication when connecting to web services. Determine which method your web service expects. Basic Authentication is simpler for initial setup but less secure; token-based requires more implementation on both sides.

2. SSL/TLS Configuration (Most Common Issue)

BlackBerry devices are very strict about SSL/TLS certificates. This is the most frequent cause of authentication failures. Here’s how to address it:

  1. Certificate Chain: Ensure your web service presents a complete certificate chain. The server certificate, intermediate certificates (if any), and the root certificate authority (CA) certificate must be sent in the correct order.
  2. Trusted CA Store: Verify that the BlackBerry device trusts the Certificate Authority (CA) that signed your web service’s certificate. You may need to add the CA certificate to the BlackBerry’s trusted store. This is usually done through the BlackBerry Enterprise Server (BES) or via over-the-air provisioning if you are not using BES.
  3. Cipher Suites: The BlackBerry device must support at least one of the cipher suites enabled on your web service. Check compatibility lists for your specific BlackBerry OS version and Java runtime environment. Common issues arise with older devices and newer TLS versions (e.g., TLS 1.3).
  4. Hostname Verification: Make sure the hostname in the URL matches the certificate’s common name or subject alternative names. A mismatch will cause authentication to fail.

Checking your Java Keystore: Use the keytool command to inspect your keystore.

keytool -list -v -keystore <your_keystore_file>

3. Basic Authentication Implementation

  1. Encode Credentials: Encode the username and password in Base64 format. Most programming languages have built-in functions for this (e.g., Base64.encode() in Java).
  2. HTTP Header: Include the encoded credentials in the Authorization header of your HTTP request: 
    Authorization: Basic <encoded_credentials>
  3. Java Example (using HttpClient): 
    import org.apache.http.*;
import org.apache.http.client.*;
import org.apache.http.impl.client.*;
import org.apache.commons.codec.binary.Base64;

public class BasicAuthExample {
  public static void main(String[] args) throws Exception {
    HttpClient client = new DefaultHttpClient();
    HttpGet request = new HttpGet("https://your-web-service-url");
    String username = "your_username";
    String password = "your_password";
    String encodedCredentials = Base64.encodeBase64String((username + ":" + password).getBytes());
    request.setHeader("Authorization", "Basic " + encodedCredentials);
    HttpResponse response = client.execute(request);
    // Process the response...
  }
}

4. Token-Based Authentication

  1. Token Generation: Implement an endpoint on your web service to generate a token after successful user authentication (e.g., username/password login).
  2. Token Storage: The BlackBerry client needs to securely store the generated token.
  3. Request Header: Include the token in each subsequent request, typically in an Authorization header: 
    Authorization: Bearer <your_token>
  4. Web Service Validation: Your web service must validate the token on each request to ensure it’s valid and hasn’t expired.

5. Debugging Tips

Exit mobile version