Android Application Question

[Klingenstein, Nate]

> That is largely what OIDC is. It's what CAS is. It's what SAML artifacts do. It's only when you move off the back-channel that things start to get different, and admittedly more complex for the SSO implementation (but NOT for the application, the thing they can't seem to grasp should not be the same thing).

I'm convinced that applications are never going to relinquish enough
control to an external module for them to ever grasp that they can
conceivably be different.  This is why I didn't think deployment
profiles versus implementation profiles necessarily exist, and I know
you disagree with that stance, as well.


> An artifact or CAS ticket *is* a token. Anything that authorizes that call is a token.

It's not a precisely defined word, but to me, the question is how much
validation and thinking the application has to do.  With an artifact,
you still have to process the SAML assertion.  CAS has a variety of
things that can come back.

simpleSSO rips out all of that and relies on HTTP and TLS for everything
on the premise that it's much easier for applications to use right and
somewhat harder for them to use it wrong.
> You mean the one that's dominated WebSSO for 20 years?
Well, I would call SAML assertions in the front channel a pretty
spectacular widespread deployment success.