CA Technologies Mobile API Gateway, Mobile App Services, and App Experience Analytics

Short Summary

Organizations increasingly need mobile apps that are secure, stable, and easy to use because digital transformation initiatives are pushing services onto smartphones and tablets, and users expect consistent functionality and security across channels. Mobile development is complicated by platform fragmentation (primarily Android and iOS), limited screen space, touch-first usability constraints, and the friction of repeated username/password entry—often mitigated by device biometrics. Enterprises also face identity challenges, including separating personal and corporate identities on corporate-issued and BYOD devices, plus the complexity of integrating mobile apps with enterprise systems and SaaS. Security requirements span authentication, authorization, messaging, and code-level vulnerability remediation, while DevOps testing becomes messy due to many user types running different app versions on diverse hardware.

To reduce one-off engineering, developers benefit from standard APIs and SDKs that provide reusable common services, improve consistency, accelerate delivery, and strengthen security by connecting apps to existing infrastructure. CA Technologies positions three offerings for this: CA Mobile App Services, CA Mobile API Gateway, and CA App Experience Analytics. CA Mobile App Services supplies standards-based APIs/SDKs for identity management (provisioning, registration, authentication, authorization), group-based access control, secure messaging, publish/subscribe messaging via MQTT, integration with CA Mobile API Gateway for tailored security controls, and developer analytics via CA App Experience Analytics.

CA Mobile API Gateway serves as an intermediary connecting mobile apps to existing on-prem and cloud APIs, supports broad identity standards (OAuth, OpenID Connect, SAML, X.509, LDAP), integrates with multiple SSO and social login providers, and adds operational controls like throttling and API orchestration. It also provides threat detection, scanning for common attacks, secure containers, mutual SSL and certificate pinning, geofencing policies, and optional integration with risk-based authentication, with FIPS 140-2 certification and Samsung KNOX support. CA App Experience Analytics delivers dashboards and deep session/crash analytics to improve usability, stability, and retention, while cautioning that session playback poses privacy risks in production.

Interesting Facts

• As of October 2016, mobile devices (smartphones and tablets) surpassed desktops/laptops for connecting to internet resources worldwide.
• Android and iOS are the two major mobile platforms, while Windows and BlackBerry have smaller market share.
• CA Mobile App Services supports user provisioning via SCIM 2.0 and LDAP using a standards-based abstraction layer in front of the identity provider.
• Group management for access control is supported via SCIM 2.0 for enterprise use and native SDKs for local groups.
• CA Mobile App Services supports publish/subscribe messaging using MQTT 3.1.1 with QoS levels 0–2.
• CA Mobile API Gateway supports OAuth, OpenID Connect, SAML, X.509 certificates, and LDAP.
• CA Mobile API Gateway can integrate with SSO products including IBM Tivoli, Microsoft ADFS, Novell Access Manager, and Oracle Access Manager.
• CA Mobile API Gateway can process social logins from Facebook, Google, LinkedIn, and Twitter and can proxy to those social media sites.
• CA Mobile API Gateway is FIPS 140-2 certified.
• CA App Experience Analytics supports both iOS and Android.

Notable Quotes

• “Users want a consistently delightful omni-channel experience.”
• “Developing security solutions one-off per project wastes development time.”
• “Testing mobile apps in DevOps environments can be chaotic, with different kinds of users (customers, partners, employees) running different versions of mobile apps on all sorts of hardware platforms.”
• “While traditional MDM is part of an overall mobile strategy, it must be accompanied by a more holistic solution that utilizes standards-based developer tools and services.”
• “Almost all apps require identity management, including provisioning and/or registration, authentication and authorization.”
• “Code level security must be addressed in every app: vulnerabilities must be remediated for a trustworthy user experience.”
• “CA Mobile API Gateway serves as an architectural intermediary between mobile app development platforms… and internal business systems.”
• “From an operational standpoint, CA Mobile API Gateway can place throttles on API usage based on user, group, time of day, geolocation, etc.”
• “The goal is to aid developers in the creation and refinement of customer apps such that they are more user-friendly and stable, which promotes a better experience and higher user retention rates.”
• “Please note that video playback capabilities are for debugging purposes, and present security and privacy risks in production usage.”