You can configure the Android channel to connect to the Oracle Chat Server in two
modes: unauthenticated mode and authenticated mode (to protect access to the
channel).
Unauthenticated mode – Use the unauthenticated mode when the client
can't generate signed JWT tokens, when no authentication mechanism is in place, or
when the client app is already secured and visible to authenticated users.
Authenticated mode – Authentication is enforced using JSON Web Tokens
(JWT). The customer's backend server generates the JWT token, which is then passed
to the Oracle Andriod SDK. This token is used for each request to an ODA speech,
text, or attachment server.
Note
To
protect access to the channel, the token must always be generated by a remote
server. It must never be generated within by the client app.
When the app
needs to connect to an ODA server, it first requests the token from the backend
server and then adds it to the Authorization header. The ODA server validates the
token, evaluates the claims, and then either opens the socket or rejects the
connection.
The JWT Token has the following claims: channelId and
userId, and the claim names iat (issued at time),
and exp (expiration time). iat signifies the time at
which the token was issued. This must be a number that represents the seconds that have
elapsed since the UNIX epoch. exp must be a number representing the
seconds that have elapsed since the UNIX epoch. We recommend setting the expiration time
to at least 30 minutes after the issued at time (iat). The token header
looks something like
this: