Guidance on X.509 login handler or ECP profile for .NET app

[Cantor, Scott]

> More info: The .NET app is a desktop application.

Ah, I didn't realize that.

> The desktop application
> makes connections to our web application using Apache CXF and DWR.  I
> suppose in this case I am thinking that the desktop app would use the client
> certificate to impersonate the user (if the X.509 login handler is the preferred
> method).

If it'a a desktop app, then the user is the one using it and authenticating. So the answer in that case is that ECP is the assumed model in SAML. But that still leaves authentication open. If you want to assume basic-auth with a password, that's about the only common denominator.
 
-- Scott