Android Application Question

[Marc Boorshtein]

>
>
>
> > Just taking a quick look i think AppAuth will require OpenID Connect
> which Shib doesn't support
>
> That seems entirely unnecessary, but maybe I don't understand what it's
> doing. In any case, so be it, nothing I can do about that.
>
>
The trick with AppAuth is that its relying on the 302 redirect you receive
after the user authenticates to the OIDC IdP  to redirect into your app
instead of to a web server.  So instead of the 302 being "
https://mysp.mydomain.com/..." the redirect is "myregisteredapp://..."
which tells the mobile device "this url is managed by my app, NOT the
browser so open it there instead" at which point the app (which is using
AppAuth) would complete the OIDC transaction by getting the id_token from
the code_token in the response.  To do that with SAML I would guess to use
the Artifact profile (which is basically all OpenID Connect code_token is)
and tell the IdP to redirect to your app's URL and then have your app use
the artifact to make a SOAP call and get the assertion.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170104/b35bf853/attachment.html>