Android Application Question

[Cantor, Scott]

On 1/4/17, 3:20 PM, "users on behalf of Marc Boorshtein" <users-bounces at shibboleth.net on behalf of mboorshtein at gmail.com> wrote:

> The hard part about artifact is requiring the back-channel communications between the idp and the sp but since most
> of the first OIDC idps were public (ie Google, LinkedIn, etc) thats not a problem where as post profile is great when you
> don't have that back channel pipe.

The hard part is actually clustering, though I grant that historically using port 8443 was a firewall issue, yes.
     
> In saml there's an SP, IdP and Agent (browser).  In OIDC the RP (SP) can ALSO be the agent.
>  Each device would be an RP and would use the code_token to get an id_token (which is the assertion) which an app can
> validate to know who you are (just like an assertion it's signed, has attributes, expires, etc).

Except I can't authenticate that call as an IdP. SAML artifact usage assumes authentication of the request because to do otherwise is just wrong. 

-- Scott