Shibboleth authentication to a RESTful API from mobile, curl, etc.

[Philip Durbin]

Hello, Shibboleth enthusiasts!

I'm curious about the state of the art for having Shibboleth users
authenticate to a RESTful API without using a browser. In my case, I'd
like to have an Android app authenticate with Shibboleth.

The API in question is for retrieving one's API token for use in an
Android app. For non-Shibboleth users, I plan to have the Android app
prompt you for your username and password, retrieve your API token on
your behalf[1], and use that API token for subsequent requests such as
searching and downloading data.

But what about Shibboleth users of my Android app? I could tell them
to copy and paste their API token into the Android app[2] but I'm
hoping to provide a better user experience than that! Ideally the user
experience would be on par with the non-Shibboleth account holder
experience described above. (Shibboleth users would have an extra step
of selecting from a list of Identity Providers, of course.)

Searching for "android shibboleth" yields questions[3] about how to
accomplish what I'm talking about and mention of something called
"Enhanced Client or Proxy" (ECP)[4].

I found an ECP client repo for Java on GitHub[5] that may be of use in
Android development but no one has updated the code in years. :(

Ohio State University seems to be using Shibboleth with mobile apps:
"The current OSU Mobile application supported on iOS and Android
includes native implementations of ECP client code. The OCIO is
working to make that code publically available, but we have no ETA on
that."[6]

It looks like SSO with native mobile applications was discussed[7] on
this list last summer, with advice from Scott Cantor to use ECP or an
embedded browser. (For a better user experience, I'd rather not use an
embedded browser.)

Am I on the right track? Any pointers? Any recommended open source
mobile apps that support Shibboleth I can look at?

Thanks!

Phil

1. Like this, given a non-Shibboleth username and password of "spruce":

$ curl -s https://apitest.dataverse.org/api/v1/builtin-users/spruce/api-token?password=spruce
| jq .data.message
"4c83e551-8be1-4af0-a0a6-196ed968f275"

2. As I suggested here: https://github.com/IQSS/dataverse-android/issues/1

3. http://stackoverflow.com/questions/5415364/shibboleth-restful-api
and http://stackoverflow.com/questions/3992014/how-to-use-single-sign-on-on-iphone-native-app

4. https://wiki.shibboleth.net/confluence/display/CONCEPT/ECP

5. https://github.com/lindqvist/simple-ecp-client

6. https://webauth.service.ohio-state.edu/~shibboleth/ecp.html

7. http://shibboleth.1660669.n2.nabble.com/SSO-with-Native-Mobile-Applications-td7603752.html

-- 
Philip Durbin
Software Developer for http://dataverse.org
http://www.iq.harvard.edu/people/philip-durbin