Implement SAML and shibboleth using restful webservices

[Cantor, Scott]

On 3/24/17, 10:59 AM, "users on behalf of Ashish Chaudhary" <users-bounces at shibboleth.net on behalf of ashish.chaudhary1202 at gmail.com> wrote:

> We are in requirement of implementation of SAML spec using shibboleth through restful APIs for communication between >mobile client and our server. Basic flow for the login is as follows : 

If you want to sue ECP, that is incorrectly modeled. You should not be sending the user's password to the SP. The client (mobile app in this case) *is* expected to be the ECP client. The client doesn't need or want a SAML token, it just wants access to the service. The SAML assertion is sent by the IdP through the ECP client over to the SP and then a session gets established with a cookie or some other token.

Not saying you *should* do any of that, most people today either use OAuth or they're using a browser on the device to do the initial login to get a token issued. This has been covered on the list, many times.

-- Scott