Android Application Question

[Marc Boorshtein]

>
>
>
> I'll be honest again.  I haven't been shy about saying it elsewhere and
> I'll repeat it here: I don't understand OIDC.
>
>
>
The 80/20 is pretty easy:

1.  SP - Generate a nonce and redirect the user to authenticate
2.  idp - auth & generate a OTP, redirect to SP
3.  SP - validate nonce came back, use OTP and optional client secret to
get an id_token via http post back channel call
4.  SP - Optional - validate the id_token against the idp's public key
5.  Do something useful now you know who's logged in

it's really just artifact profile saml using JSON and JWT instead of XML
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170104/435152aa/attachment-0001.html>