Android Application Question

[Andrew Watson]

Ok, so what is the best approach to authenticate/authorize users of a
mobile application against a Shibboleth IDP? It doesn't look like it
supports AppAuth, OpenID Connect or OAuth2...

i might have to go with the system browser redirect to intent URL with
encoded token.

On Wed, Jan 4, 2017 at 11:57 AM Cantor, Scott <cantor.2 at osu.edu> wrote:

On 1/4/17, 11:50 AM, "users on behalf of Andrew Watson" <
users-bounces at shibboleth.net on behalf of andrew.watson at makeandbuild.com>
wrote:

> It seems like the most logical approach would be to use something like
the OAuth2 Password grant
> (http://oauthlib.readthedocs.io/en/latest/oauth2/grants/password.html)
where
>  I'd take credentials from the user in the native app and exchange them
for an access token
> which expires after X seconds.

That's simply the OAuth version of ECP, but it's not advisable. That
precludes any more advanced forms of authentication without ugly
workarounds and it destroys the branding and security measures that
organizations take to at least try to limit phishing. It also presumes
support for that profile by the authenticating organization, and that's
exactly the sort of coupling that using the browser avoids.

-- Scott


--
To unsubscribe from this list send an email to
users-unsubscribe at shibboleth.net

-- 
--
Andy Watson
Make and Build
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170104/6d13464d/attachment.html>