Android Application Question

[Andrew Watson]

' instead of the 302 being "https://mysp.mydomain.com/..
<https://mysp.mydomain.com/>." the redirect is "myregisteredapp://..." '

That's exactly what I was thinking.  Since I have more control over the SP
than the IdP I was thinking of doing that redirect there, though.

Let me back up a step... What I have is an existing web app (SAML SP,
right?) that is currently set up to use the (Shibboleth) IdP and
authn/authz its users.  What I'd like to add to the mix is an android
application that can make API calls to the web app but only if people are
authenticated and authorized to do so.

So the android app needs to present something to the SP like a browser
would present cookies.  If the user isn't authn/authz'd currently we'd open
a browser, point it at the SP and complete the login flow (
https://wiki.shibboleth.net/confluence/display/CONCEPT/FlowsAndConfig) but
at the end of step 6 we'd issue another 302 to the Intent of the Android or
iOS app to get them back into the native application...


On Wed, Jan 4, 2017 at 2:01 PM Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 1/4/17, 1:48 PM, "users on behalf of Andrew Watson" <
> users-bounces at shibboleth.net on behalf of andrew.watson at makeandbuild.com>
> wrote:
>
> >    Ok, so what is the best approach to authenticate/authorize users of a
> mobile application against a Shibboleth IDP? It
> > doesn't look like it supports AppAuth, OpenID Connect or OAuth2...
>
> Unless I'm totally confused, AppAuth is not something the IdP supports or
> doesn't support, it's a detail of the mobile platform to mediate the
> browser interaction to improve the user experience.
>
> When you secure services with OAuth or cookies, you run an *SP* (in SAML
> parlance). The SP is the thing issuing the token(s) back to your
> application. It needs to authenticate the user. That's done with WebSSO and
> a browser, to interact with an IdP. The IdP is not issuing the tokens. If
> you don't want to operate a SAML SP, then you'd have a problem, but there
> are plenty of simple ways to do that if all you need to protect is a token
> issuing endpoint, the Shibboleth SP included.
>
> This whole thread is about the interactions between your app and the
> browser client. That is where all these new tricks come into play and the
> part that's rapidly evolving.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-- 
--
Andy Watson
Make and Build
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170104/43792ec6/attachment.html>