Android Application Question

[Cantor, Scott]

On 1/4/17, 5:07 AM, "users on behalf of Etienne Dysli-Metref" <users-bounces at shibboleth.net on behalf of etienne.dysli-metref at switch.ch> wrote:

>    On 03/01/17 23:09, Marc Boorshtein wrote:
>    > I would use the system web browser (NOT an embedded one).
>    
>    Will the mobile application have access to the SP and IdP session
>    cookies that the system browser gets? In other words, can the
>    application make authenticated HTTP requests to the SP within that session?

Most apps like this use OAuth, which is to say they just reinvent cookies. They get it from the URL typically, or via some callback, and stash it off for use as a super-cookie. At least on Android I think they give you all this machinery for free now, and by using the system browser, you basically isolate the step of authenticating the user to the IdP to get the token, just like the non-mobile case.

-- Scott