SSO with Native Mobile Applications

[Eric Goodman]

Is it bad form to hijack an old thread without changing the topic? Let me know and I'll repost in a new thread.

>>I now have an ask to simply generate the signed/encoded SAML token so 
>>that a native mobile (android/iphone) application can send it for SSO 
>>without the need for browser.
>>Are they any options/suggestions for this?

>OSU has a mobile app for Android and iOS built on the SAML ECP profile. 
>If you want to use SAML with mobile, that's how it's done, either that 
>or with an embedded browser.
>
>-- Scott

Scott, 

Per other threads, I presume your SAML ECP interface on your IdP:

* is using basic-auth
* is world accessible

Other than "mobile compatibility demanded it", were there any other discussions, requirements, mitigations that OSU went through before enabling that interface?

In particular I'm thinking of anything you might have done that could help users understand what apps (especially mobile ones) are "sufficiently trustworthy" to hold or proxy their credentials. (This would include things beyond technical solutions, such as education campaigns, etc).

Same question is posed for any other campuses that have implemented non-embedded-browser authentication solutions for mobile.

Thanks,

--- Eric