mobile auth - app sends GET, IdPv3 wants POST

[Cantor, Scott]

> Our IdP shows the following:

That's not telling me what endpoint you're trying to use, but if it's the ECP endpoint, that's SOAP.

> I'm picking this up brand-new, a previous conversation with the IBM Conn
> Cloud folks suggested that if we're really doing http basic auth at the IdP then
> a GET should be accepted. 

Basic-auth is not about POST or GET, it's orthogonal. The issue is the endpoint you're using and the binding defined for accessing it.

> Is the mention of HTTPSOAP11Decoder in the IdP
> traces a sign that we have the wrong profile configured for mobile clients ?

There is no "mobile client" support. There's a non-browser profile implemented, that's ECP, and that's a SOAP exchange. It is *not* meant to be used to simply spoof authentication and then go on with life. That's equivalent to the old chestnut of using POP servers to do password checks because you can't get access to the real authentication services.

The IdP isn't designed to be used as a generic authentication service.

-- Scott