On this page

Introduction

The Linchpin Mobile App can be configured to connect to one or more Confluence systems. However, only one active connection is possible at the same time. This active connection lets the user interact with the connected Confluence instance via the app.

Connection types

The Linchpin Mobile app can be connected to a Confluence instance in two ways. For both of the connection types described below, each login is based on an access token generated for a single device. The token remains valid until it is explicitly deleted or the Confluence user is deactivated or deleted.

If a user is deactivated or deleted in Confluence, the access token remains unaffected. However, from this point on, requests from the user are no longer authenticated by the system, so that no information or content can be retrieved from the instance.

Direct connection

To use the direct connection, the Confluence instance must be directly accessible from the mobile device. The Confluence instance can be on the same network or available through a VPN connection which makes it look like the mobile device is in the company network, or it can be an instance that is freely accessible via the internet.

The connection is technically established between the app and the Confluence instance when a user logs in for the first time with their username and password. Users can enter this data into the app. The user or an administrator can generate a QR code, which the user can then scan in the app with the device's camera. Scanning the QR code automatically fills in all login data, but the user still has to enter their password.

We provide in-detail documentation for our authentication process for direct connections - see here for more

Linchpin Mobile Gateway Service

The Linchpin Mobile Gateway Service is designed for cases where the Confluence instance is protected behind a firewall. In most cases, direct access to the system from the internet is not technically possible. The gateway service facilitates the connection between mobile devices on the internet and the protected Confluence instance. A permanent connection to the gateway service is established by the Confluence instance, and all data traffic is sent via this permanent connection.

A connection between the app and the protected Confluence instance can only be established via QR codes. These codes can only be used once and are therefore linked to a single device. Users can generate a QR code for for themselves, scan it with the app and establish the connection. An administrator can generate and send QR codes to specific users. The user can then scan this QR code and establish the connection on their device.

We provide in-detail documentation for our Linchpin Mobile Gateway Service - see here for more

Encrypted communication

Direct connection

The direct connection uses SSL and is therefore encrypted using this standard. If the Confluence is not configured to use SSL, no encryption takes place. This is not recommended, as all data traffic is then freely readable.

With SSL encryption, all HTTP communication is encrypted according to this standard. The actual user data transferred in the body of the HTTP request is end-to-end encrypted using SSL. The only information that is not encrypted is the requested URL. All user data and header data is encrypted.

Connection via the Linchpin Gateway Service

• All data transmitted between Confluence and the app via the gateway service is encrypted with SSL (WSS).
• The contents of the requests are encrypted with AES-128. The headers of the Confluence request are also encrypted, the headers for communication with the Linchpin Gateway Service are readable only by the Linchpin Gateway Service through the WSS connection.
• The Linchpin Gateway Service does not know the encryption key that is used. When a device logs on, a new random key is generated and exchanged directly between the mobile app and the Confluence app. The Linchpin Gateway Service cannot read the data and forwards it unmodified.
• From the technical point of view, both the on-site and Cloud gateway function in the same way.

Cached data on the mobile device 

What is cached? How long is this data stored?

• To speed up content loading times, images are stored in the cache with Base64. Images are cached for 24 hours then deleted.
• A list of microblog topics is also cached. This data is cached for one hour and then deleted.
• Shared images are temporarily cached. This temporary storage is cleared when the app is launched.
• Shared files are temporarily cached. Once the files has been successfully shared, these temporary files are deleted.
• The above data is stored as a key-value-pair in the app sandbox and is therefore only accessible within the app itself.
• Data cached on the mobile device currently is not encrypted.

Mobile user management

What data is stored in the Linchpin Mobile Confluence app?

• The user's UserKey.
• A token used by the mobile app to authenticate itself to Confluence.
• A randomly generated encryption key. *
• A randomly generated identification key for the Linchpin Gateway Service. *
• The date on which the token was created.
• The date on which the device last connected to the Confluence.
• A token generated by the Google Firebase service if the user requests push notifications.

*: This information is only stored while accessing the Linchpin Gateway Service.

What data is stored per instance in the Linchpin Mobile device app?

• The base URL of the Confluence instance.
• The user's username.
• A token used by the mobile app to authenticate itself to the Confluence app.
• A randomly generated encryption key. *
• A randomly generated identification key for the Linchpin Gateway Service. *
• A list of topics to which the device has requested push notifications.

*: This information is only stored while accessing the Linchpin Gateway Service.

What happens if an user account is deactivated for a Confluence instance?

• The access tokens in the Linchpin Mobile administration area are not deleted.
• However, requests from the user are no longer authenticated by the system, so that no information or content can be retrieved from the instance.

What happens if an user is deleted from a Confluence instance?

• The access tokens in the Linchpin Mobile administration area are not deleted.
• However, requests from the user are no longer authenticated by the system, so that no information or content can be retrieved from the instance.

What happens when an access token is removed in the Linchpin Mobile administration area?

• The user can no longer connect to the Confluence instance via our app app because the access token no longer exists in the Linchpin Mobile administration area.

What happens when an instance is deleted from the Linchpin Mobile device app?

• The data stored for this instance is deleted from the mobile device. 
• The access token in the Confluence instance is not deleted.

Why can one user have multiple access tokens?

• Each access token is valid on only one device. When one user uses multiple devices, each device will have its own access token.