Android Application Question

[Klingenstein, Nate]

"at which point the app (which is using AppAuth) would complete the OIDC
transaction by getting the id_token from the code_token in the response."

"To do that with SAML I would guess to use the Artifact profile (which
is basically all OpenID Connect code_token is) and tell the IdP to
redirect to your app's URL and then have your app use the artifact to
make a SOAP call and get the assertion."

Yes.  It's the same pattern that simpleSSO follows, except without an
assertion or a token at all.  Instead, it just returns fields in
response to the call.

I think you're going to see a whooooole lot of this pattern.