Android Application Question

[Cantor, Scott]

On 1/4/17, 2:59 PM, "users on behalf of Klingenstein, Nate" <users-bounces at shibboleth.net on behalf of nklingenstein at calstate.edu> wrote:

> Yes.  It's the same pattern that simpleSSO follows, except without an
>    assertion or a token at all.  Instead, it just returns fields in
>    response to the call.

That is largely what OIDC is. It's what CAS is. It's what SAML artifacts do. It's only when you move off the back-channel that things start to get different, and admittedly more complex for the SSO implementation (but NOT for the application, the thing they can't seem to grasp should not be the same thing).

An artifact or CAS ticket *is* a token. Anything that authorizes that call is a token.

>    I think you're going to see a whooooole lot of this pattern.

You mean the one that's dominated WebSSO for 20 years?

It doesn't solve anything that you think the existing protocols have somehow failed to solve, with the exeption that adding polling back in does address a number of sessioning use cases that SAML deliberately decided not to solve to avoid coupling systems together that tightly.

-- Scott