PostAuthenticationFlows for non-SAML profiles

[David Langenberg]

> On Aug 21, 2015, at 8:16 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> 
> On 8/21/15, 6:52 AM, "dev on behalf of Misagh Moayyed" <dev-bounces at shibboleth.net on behalf of mmoayyed at unicon.net> wrote:
> 
>> Moreover, does it make sense for the Idp to actually tell the user where
>> they would be going if they press Accept/Authorize? Show a URL on the page
>> that says "This is where you'll end up if you press X"? 
> 
> URLs are not a concept users understand well, I don't know in the general case if that helps or hurts. In SAML, I think it would be fairly confusing since it wouldn't be an application URL.

+1.  I'm guessing you wanted to display the Redirect URL to the end-user.  IMO that's a bad idea as those endpoints are generally application endpoints.  It'd be akin to showing the user an SAML ACS URL.  They'd get even more confused if it was a mobile application & the Redirect URL was something like mypersonalapp://proces-oauth-response.

> 
> OTOH, showing maybe just the virtual host might be sensible.

I still cringe at this (mypersonalapp://process-oauth-response)

Dave