HTTP-POST vs. ECP

[Jon Carlson]

We are in the process of designing SSO plugin support for our enterprise backup product.  Shibboleth/SAML will be the first SSO implementation, if everything goes as planned.  Thank goodness for OIOSAML.  :-)

We are trying to do this as generically as possible, hence we are considering using the HTTP-POST binding for our desktop and mobile apps, in addition to the web app.  Which means we would need to imbed a browser into our apps.  No problem there, really… its just not as pretty as entering credentials into the regular app.

1) My question is, how common is this for desktop and mobile apps?  I'm reluctant to build in ECP support if Shibboleth is one of the few SAML providers that implements ECP.

2) Do most IdPs out-of-the-box have login web pages that scale well to small browser windows?  (think Android, iPhone browsers)  If not, I'm assuming that each organization running an IdP can customize this page to work in small browser windows.

3) An ECP question because I think I'm missing something:  The ECP spec does not specify how the username and password gets sent to the IdP by the client.  I don't understand that because, using the browser profile, an IdP can return whatever form it wants to the browser and the person can figure out what goes into the fields presented him.  But a desktop app cannot be pre-programmed to stick the username and password into a form/message it has no prior knowledge about…. unless it too imbeds a browser for the credential entering.

Thoughts?

Thanks!

- Jon
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120713/de639a06/attachment.html