Android Application Question

[Cantor, Scott]

On 1/4/17, 2:47 PM, "users on behalf of Marc Boorshtein" <users-bounces at shibboleth.net on behalf of mboorshtein at gmail.com> wrote:

>  To do that with SAML I would guess to use the Artifact profile (which is basically all OpenID Connect code_token is) and
> tell the IdP to redirect to your app's URL and then have your app use the artifact to make a SOAP call and get the
> assertion. 

IdPs don't support artifact much in practice, so not really a practical option at this point, at least not for the Shibboleth case. If we needed to start moving in that direction, there are significant changes we'd have to push on, such as defining a new artifact format (which only Shibboleth would end up supporting).
 
But what's broken here is that it can't be the app that consumes the URL and requests the id_token, it has to be a web server the app is talking to. In which case it shouldn't matter what the URL is or what protocol is involved. If it's specific to OIDC, that would imply the client app is doing the id_token call, and that wouldn't be secure.

So either they got this all really wrong, or more likely they just used it to drive an agenda without a good reason.
 
-- Scott