A couple years back I wrote a small and very incomplete component that authenticated users coming from outside of Joomla! i.e. a mobile application.
Is there a proper or preferred way of handing this?
Joomla Stack Exchange is a question and answer site for Joomla! administrators, users, developers and designers. It only takes a minute to sign up.Sign up to join this community
Based on your comment, you are looking for an OAuth setup. As far as I know, Joomla has Oauth classes built in to the core, but these classes are to allow Joomla to act as the client (your mobile app is a client in your case). They do not give you the option to run as a server.
I just recently used this package to set up an OAuth2 Server on the Joomla Framework: https://github.com/bshaffer/oauth2-server-php. It worked very well. This will definitely take a few days to get all set up and running, but you can definitely set this up within Joomla.
There are a couple different methods to authenticate a user within OAuth2. The common approach is to have the client redirect the user to your site to enter their login information. Then you redirect the user back to the client with a code that the client turns into an access token.
Since it sounds like you also control the mobile application, this is unnecessary. You trust the client (I hope), so you can just have the user login to the application.
You would then use the "Resource Owner/Password Credentials" option outlined here: http://bshaffer.github.io/oauth2-server-php-docs/overview/grant-types/. This has the mobile app just ship the user/password entered over to your Joomla site, and then the Joomla site ships back a token for validation. The token can be saved and used the next time instead of having them login again.
This gives you control on the Joomla site to invalidate tokens to force mobile users to login again.
You want to use something like OAuth/OAuth2. My idea here is not true OAuth but based on my knowledge of Joomla the easiest way.
Validate the user via API call to the component in Joomla to create a token that is attached to their IP, then redirect them with a GET request that validates that token and creates the session for them. The token is easy to secure since it relies on the IP to authenticate the already authenticated user, best way is to make sure it can only be used once. For the API call it should be a SSL encrypted POST request for the best results.
So send a POST request to you component containing the users IP, username and password. If it is all valid then you send back a token. You then redirect the user to your component containing that token to set the session. I do not know how the Joomla API can be used to log a person in, but I am sure there is something for it.
Edit: Seems csbenjamin answer has went into the API for logging in.