Android Application Question

[Marc Boorshtein]

>
>
>
> Wouldn't it be better all the way around if the Shibboleth IdP just
> supported OIDC?
>
>
>
I'm not going to say shib should support OIDC, but what makes OIDC hard is
session management (which is why the post profile in saml is so popular,
there is no session management by the idp really, at least not at the same
level).  In the latest release of OpenUnison (full disclosure - my
company's open source idm project, uses opensaml for saml2 idp/sp) we just
added OIDC.  OIDC its self is pretty straight forward but the biggest issue
is proper session management.  Another route you could go is to use an
identity proxy to go from OIDC to SAML2 as even if shib supported OIDC the
large deployments wouldn't start supporting it over night.  You can do it
with OpenUnison (don't know if it would work with AppAuth though) and I
think KeyCloak (Red Hat's SSO project) will let you go from OIDC --> SAML.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170104/f9a2b301/attachment.html>