I am used to building apps in larger infrastructures. In a startup, how do I setup SMTP for a mobile app? Is there a place I can use for hosting this?
There are a couple of possible approaches:
One option is to not attempt to interface with SMTP/IMAP/POP servers directly in your app. You can, alternatively, send emails from your app via MFMessageComposeViewController, which gives you a standard compose email user interface. This is very easy to do.
To handle inbound emails you can let the user receive their emails via the standard Mail app (that way users don't have to go to different places to receive their emails). You integrate inbound emails with your app using a custom URL scheme. You can then send the user an email using this custom URL scheme, and if they get the mail on their iOS device and have that app installed, when they click on the link they will be taken to your app, passing it information from the URL in the email.
For example, if you defined a custom URL scheme of yourapp://, you can just include a hyperlink to that URL in your email (or text message or your web site), and if the user is on their iOS device, when they click on that link, they'll be taken to your app. If you google "iOS custom URL scheme tutorial", you'll see examples of the plist entries you need to make in your app for it to respond to a custom URL scheme. The Implementing Custom URL Schemes reference shows you what sort of changes you need to make to your app delegate to actually pass data in your custom URL to your app.
Alternatively, you can (a) sign up with any Internet Service Provider (ISP) that offers mail hosting; (b) write an app that sends email by connecting to that ISP's SMTP server; and (c) retrieve email by connecting to that ISP's IMAP or POP servers. Clearly you'll have to pay fees to the ISP, the quality of your app is linked to the quality of the ISP you partner with (so pick a good one), and you'll have to do your own SMTP/IMAP/POP integration in your app (and you'll have to write your own code to do that or use a third-party library for that, as this is not standard Cocoa Touch functionality). In my opinion, you'd need a pretty compelling business case to go down this road, though it can be done.
You could avoid email altogether, and develop a web service for letting the users send and receive messages. (This might make sense if the app is just sending messages between users of your app, for example.) Again, you'll have to contract with an ISP for web hosting, and you'll of course have to undertake the non-trivial exercise of writing your web service code. But this is architecturally cleaner than integrating with SMTP/IMAP/POP servers if the purpose of your app to facilitate communication between users of your app.
You haven't provided enough information for us to assess which approach best suits your situation.
Related
At work we have developed an individual customer specific software application that is in use for a long time. We have a new requirement in this same program to implement an option for sending emails directly from the program.
The user is able to add his own email account with the credentials and login through our program. For Microsoft and Gmail accounts OAUTH is implemented and something here is not very clear.
For Gmail-API we have made an OAUTH Client and Consent screen on Google Cloud Console which we need to publish and verify and here is where the problems start. I am not very clear with the whole process of verifying the app.
In the steps for verifying is stated that we should verify a domain for the app, but this software is not hosted anywhere on internet and is not publicly available, it is available to a number of specific users (2000-3000).
Also Google requires a YouTube video of the software to be available publicly, which we are not able to upload because of customer requirements. Also here is required a Data Protection Policy page for the application which we as a developers don't have because we are only developing the software.
Other thing that is not clear to me, how is this type of software rated by Google, internal or public?
Have anyone experience with this or something similar?
Verifying an app for one of the Gmail scopes is a very complicated process. This process depends upon which scope of authorization you are requesting of the users.
In your case you are trying to send an email so you are using the users.messages.send method from the Gmail api. This uses a restricted scope. Which means you will need to go though the full process.
First of it doesn't matter if your application is hosted or not. It also doesn't matter that you give this app to a limited number of users. What matters is the scopes you are using.
You will need to ensure that your domain has been registered via google search console. So this app will need a domain
Once that is done you will be able to host your website, and the privacy policy on that domain.
You will need to create a YouTube video showing your application running, and how authorization is used.
You will also need to submit to a third party security checkup of your application which is not free and will need to be done once a year.
All of this is needed because of your consent screen it doesn't matter if its hosted any where, It also doesn't matter if this is only available to specific number of users.
If all of the users are part of a single google workspace account, that has created your client id and client secrete then you can set the app to internal and you wont need to be verified. This only works for google workspace domain accounts.
I'm building a small email app (on iOS first) for internal team use only. We also have a Slack team that I'm rolling out to the whole group (about 250 people) around the same time I'm launching the app.
I'm going to have a lot of older and tech-phobic users, so I'm trying to make things as easy as possible for them. Since I'm writing the email app, I figure to making on-boarding even easier I can:
Check if they've got the Slack app installed (via the canOpenURL method)
Send them to the App Store to download if they don't
Open the Slack app for them if they do
Look for the magic login email
Automatically open the URL from the email.
All that is great, but it would be fantastic if I could trigger sending that email automatically and don't even need to send them to manually put in the team URL and their email. Anybody know a way?
CLARIFICATION:
One big reason I want to do this that I didn't make very clear is that when the Slack app sends the email it prompts you to go to your email app to receive your login link, but since iOS doesn't allow changing the default email app, it will send them to the wrong one for my user's purposes.
Sure. If you already have the emails of your target group you can generate the invitation mails programmatically with a small script.
You will need to use the undocumented API method users.admin.invite for that.
I am building a mobile-focused web application, to later convert to hybrid, and I would prefer new user registrations confirm the user's phone number versus their email address.
I would like to send a new user an SMS with a unique code. When they first log in, they must enter that code to activate their account.
I have a custom SMS service that is sending SMS fine, and would like to know how to integrate this into the Identity registration process.
Please note that I do not wish to use SMS for routine two-factor authentication.
You can use create additional actions in your account controller
and use methods from Microsoft.AspNet.Identity.Core
UserManager.GenerateChangePhoneNumberToken
Send sms with token
UserManager.VerifyChangePhoneNumberToken
Add custom logic to authorization
There are several ways to accomplish this.
Cheap but not reliable or enterprise ready is to build an app on a device you own and have those other devices send an SMS to it. You can process the SMS and reply however you like. With unlimited texting plans, it would be fine. It's just not redundant or reliable (the phone battery could die, you may need to do updates that could interrupt service, etc.)
Work with a company like Twilio (https://www.twilio.com/) and use their SMS gateway, API and services to build, quickly and cheaply (for the most part) the type of service you are looking to provide. There are competitors to Twilio and I'm not endorsing them, just providing them as an example.
Obtain your own SMS gateway (https://en.wikipedia.org/wiki/SMS_gateway) and then do heavily integrated and customized services.
If this is just a proof of concept at the enterprise level or you don't know what your user adoption rate will be, then #1 is probably fine until you need #2. #3 is rarely the best option.
I'm planning introduce two factor authentication to my iPad application. Currently user login to my app using a username and password. That username and password is validate from the back end web server devloped using .Net. If user is authorize to login then he can access the iPad application.
Now I want to introduce two factor authentication to validate user. I want to know what are the options we have here. Since we have user’s phone no with us I was thinking of sending a passcode to his phone each time he tries to login to the iPad application. But iPad doesn’t support sending messages over the GSM/CDMA network. Is there a way to achieve this? (Thought about getting an SMS gateway from the local ISP and writing SMS a server. But it cost more) Third-party module will be ok.
Check google authenticator. https://code.google.com/p/google-authenticator/
I think it is quiet good for two-step authentication.
Here is source code for server side (it is on php but i think it is not big issue to convert it to .NET or another platform) https://github.com/chregu/GoogleAuthenticator.php
As I know it uses Time-based One-time Password Algorithm http://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm
You can send an SMS to the mobile phone of the user with a code.
After that the user puts the code and the APP validates the code making a request to the server.
The SMS is sended after the user sucessful introduced the username/password.
Other option (less expansive) is to send that code by email.
You should try the google Authenticator
There are other's like https://www.gauthify.com, who offer this service.
You may be interested in looking in this StackOverflow Post.
I cannot fully express how much I am impressed by Twitter's recent TFA implementation, it is extremely convenient and (assuming they didn't botch the protocol) much more secure than many other forms of TFA.
Here's a description written by Wired.
But to summarize you activate a device for TFA and it generates a private (device)/ public (server) key pair. When you try to login after receiving correct username/password credentials the server sends a push notification to the application on any authorized devices encrypted with the public key and the application decrypts the nonce and sends the nonce back to the server and is given a session.
And of course as others have mentioned, there are prebuilt services you can use such as Google Authenticator, but they tend to be clunkier and there are concerns about SMS and TOTP security.
Two Factor Authentication means confirming something the user knows (their password) and something they have in their possession (like a physical key, a badge, or RSA key fob; the important part is it's a physical object other than what you are giving them access into). Sending a push of any kind to the iPad they are using to login to the app defeats the purpose and is no better than single factor (password only). Your only choices are:
Distribute an RSA key fob (or similar). Probably not an option because of the cost & management overhead associated.
Create an authenticator app that only works on a separate device than the iPad with your app on it (along the same lines as the Google Authenticator app). You can probably prevent the authenticator app being run on the iPad by registering a URI scheme for your protected app and trying to open it from the authenticator every time the authenticator is opened. If the protected app opens that means the user is trying to run both on the same device and the authenticator should not validate them.
Send a SMS to their registered phone with an authentication code. By using SMS here you're forcing the user to have both devices to be able to login, which is the key to TFA. Note that a creative user could register a Google Voice number (or similar VOIP with SMS app) on their iPad, thus circumventing the physical aspect of TFA.
Suppose I have an email address that only receives a specific type of email, i.e. an automatically generated receipt email from a transaction.
I would like to build an iOS app to receive the email text from this email address and parse according to a predefined format and display the results. Is it possible to do this without dealing with the email server directly from the app?
Meaning can I for instance piggyback off the native mail client (assuming it is set up to receive pushed email sent to the email address). I tried looking through Apple's docs for iOS but could not find anything useful. Anyone know of something?
3rd party apps have no way to integrate with the Mail app or to make use of any configured mail account the user has setup on the device.
However, you can write an app that can access external email accounts if the user provides all of the usual email account details. The App Store has several 3rd party mail apps that serve as replacements for Apple's Mail app.
If your app is written to work with a specific email account, and not one entered by the user of the app, then you can hardcode all of the account details in the app.
Your app is basically a run of the mill email client. You just have to know how to access IMAP or POP3 accounts, retrieve the emails, and process them as needed.
Again, there is no way your app can intercept or make use of any emails accessed by any email accounts the user has setup for use with the standard Mail app.
There are at least two aspects to your question:
How do I get an email to open in my iOS app?
Put the data in an attachment and see this link
What format can I use in an email attachment to transport persistent
objects?
I've had decent results with NSKeyedArchive as an interchange format. There are lots of other choices, depending on what generates the receipts attachments.
Post a followup with your choices. Good luck!