Idp verification via smartphone app?

[Nate Klingenstein]

Brad,

With the caveat that I'm not very familiar with iOS or other mobile  
platforms, you might take a look at recycling the integration approach  
used by tiqr.  Here's a basic sequence diagram:

https://tiqr.org/technical/

If you're looking to tie a web browser on the mobile device(rather  
than on a desktop/laptop/etc.) to the authentication performed by an  
application running on the mobile device, you might consider simply  
encoding some sort of token that's signed by the biometric  
authentication service and delivered to the app(encrypted, if  
desirable).  This token would then be placed by the app in the query  
string in the final redirect to the new web page and validated by a  
custom authentication mechanism.

I'd also recommend closely scrutinizing the security of a model where  
the user's biometric data is sampled by or validated by a mechanism/ 
application over which they may have total control.

Hope something in here is useful and I haven't missed something obvious,
Nate.

On Jun 6, 2012, at 3:35 , Brad Larson wrote:

> Assuming I have a custom Idp login page which launches my iOS
> biometrics app, and my biometrics app can validate the user, what is a
> safe way to return control to my Idp and finish the user verification?
>
> In iOS, I can load my app using a custom URL.  However I cannot return
> data from my app to the web page.  The only option I am aware of is to
> have my app load a new web page when the user validation is done.  How
> do I make sure the new web page which is opened was loaded by a valid
> user and not somebody guessing random URLs?
>
> Any thoughts or suggestions are appreciated!
> Brad