SSO on Native Mobile Apps using Shibboleth IdPv3

[Shagun Akarsh]

Hello,

I have deployed a Shibboleth IdPv3 and SP (using spring-security-saml2) for
single sign on using SAML2 HTTP POST bindings with "unspecified" nameID
configured. Everything works fine with web-browsers.

For enable SSO on native mobile apps I found these solutions:

1. In-app web-view (Link <https://blog.box.com/blog/rethinking-mobile-sso/>)
2. SwitchAAI solution for Mobile Apps (Link
<https://www.switch.ch/aai/support/tools/aai-for-apps/>) -- SAML2 based IdP
with another proxy Server with OAuth2, using AttributeQuery to back-channel
to IdP.
3. ECP protocol for non-browser clients (Link
<https://wiki.shibboleth.net/confluence/display/IDP30/ECPConfiguration>) --
back-channeling using SOAP

>From the articles I have read (Link1
<http://blog.scottlogic.com/2015/11/19/oauth2-with-saml2.html>, Link2
<https://developer.salesforce.com/page/Single_Sign-On_for_Desktop_and_Mobile_Applications_using_SAML_and_OAuth>,
Link3
<http://security.stackexchange.com/questions/33855/saml2-vs-oauth-what-are-some-reasonable-relationships>,
Link4
<https://www.mutuallyhuman.com/blog/2013/05/09/choosing-an-sso-strategy-saml-vs-oauth2/>,
etc) till now on this topic most popular solution seems to be having an
additional Oauth2 server in between browser (user-client) and IdP to store
mapping of persistent ids, and generating OAuth2 access_token based on it.

I also found IETF draft on "SAML 2.0 Profile for OAuth 2.0 Client
Authentication and Authorization Grants" Link
<https://tools.ietf.org/html/draft-ietf-oauth-saml2-bearer-23>. Is there
any standard implementation (library like spring-security-saml2) for this ?

I want our SP mobile application SSO experience to be as close as possible
to native app. Kindly suggest what could be the best approach for enabling
SSO for native mobile apps.


-- 
Shagun Akarsh
Ph: +91-9902095371
Wooqer,
Bangalore.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160912/bd7cc603/attachment-0001.html>