Android Application Question

[Cantor, Scott]

On 1/4/17, 11:50 AM, "users on behalf of Andrew Watson" <users-bounces at shibboleth.net on behalf of andrew.watson at makeandbuild.com> wrote:

> It seems like the most logical approach would be to use something like the OAuth2 Password grant
> (http://oauthlib.readthedocs.io/en/latest/oauth2/grants/password.html) where
>  I'd take credentials from the user in the native app and exchange them for an access token
> which expires after X seconds.

That's simply the OAuth version of ECP, but it's not advisable. That precludes any more advanced forms of authentication without ugly workarounds and it destroys the branding and security measures that organizations take to at least try to limit phishing. It also presumes support for that profile by the authenticating organization, and that's exactly the sort of coupling that using the browser avoids.

-- Scott