With the 1.5.5 release of the Ribbit Platform it is now possible for an "admin" user to impersonate any other user within a domain. Not only is this feature important for managing users and accounts in a given domain, it is especially useful for testing IVR applications.
The Default Authentication model is not appropriate for all applications, particularly those applications that are not trusted by the domain owner or the domain users. It is a security risk for that application to request credentials from the user and authenticate these users directly through Ribbit. To accomodate this application scenario, Ribbit supports 3-Legged OAuth for authentication. However, this authentication model is only intended to support applications acting as Guests within the Ribbit Mobile domain at this time.
Many Ribbit applications are built using client-side SDKs in JavaScript, Silverlight, or Flash and communicate directly with the Ribbit Platform without the intermediation of a server-side component. In these scenarios it is not appropriate to use the Default Authentication model, which requires that the application secret is stored on the application to sign requests to the Ribbit servers. Storing secrets this way is considered a serious security risk for developers as these secrets may be used to create other users in this domain.
AllApplicationsandUsersexist
within a developer's Domain, which defines a unique user and application
namespace for the developer such that all users in a Domain may access
all Applications in the same Domain.
