Android Application Question

[Cantor, Scott]

On 1/4/17, 1:48 PM, "users on behalf of Andrew Watson" <users-bounces at shibboleth.net on behalf of andrew.watson at makeandbuild.com> wrote:

>    Ok, so what is the best approach to authenticate/authorize users of a mobile application against a Shibboleth IDP? It
> doesn't look like it supports AppAuth, OpenID Connect or OAuth2...

Unless I'm totally confused, AppAuth is not something the IdP supports or doesn't support, it's a detail of the mobile platform to mediate the browser interaction to improve the user experience.

When you secure services with OAuth or cookies, you run an *SP* (in SAML parlance). The SP is the thing issuing the token(s) back to your application. It needs to authenticate the user. That's done with WebSSO and a browser, to interact with an IdP. The IdP is not issuing the tokens. If you don't want to operate a SAML SP, then you'd have a problem, but there are plenty of simple ways to do that if all you need to protect is a token issuing endpoint, the Shibboleth SP included.

This whole thread is about the interactions between your app and the browser client. That is where all these new tricks come into play and the part that's rapidly evolving.
 
-- Scott