Implement SAML and shibboleth using restful webservices

Ashish Chaudhary ashish.chaudhary1202 at gmail.com
Fri Mar 24 12:41:26 EDT 2017


Thanks for the response. So if i want to do a social login with SAML and
shibboleth in this case then what would be the flow? Also is there any
concept of validating these cookies or tokens sent to the mobile client. We
have a scenario where we want to support the offline login on the mobile
client when internet is not available so that the mobile client communicate
with a blue-tooth peripheral. Is this possible?

Is there a concept of mobile IDP to validate the tokens on the mobile
client?

Regards,
Ashish Chaudhary



On Fri, Mar 24, 2017 at 9:13 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 3/24/17, 10:59 AM, "users on behalf of Ashish Chaudhary" <
> users-bounces at shibboleth.net on behalf of ashish.chaudhary1202 at gmail.com>
> wrote:
>
> > We are in requirement of implementation of SAML spec using shibboleth
> through restful APIs for communication between >mobile client and our
> server. Basic flow for the login is as follows :
>
> If you want to sue ECP, that is incorrectly modeled. You should not be
> sending the user's password to the SP. The client (mobile app in this case)
> *is* expected to be the ECP client. The client doesn't need or want a SAML
> token, it just wants access to the service. The SAML assertion is sent by
> the IdP through the ECP client over to the SP and then a session gets
> established with a cookie or some other token.
>
> Not saying you *should* do any of that, most people today either use OAuth
> or they're using a browser on the device to do the initial login to get a
> token issued. This has been covered on the list, many times.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to
> dev-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170324/93d3aceb/attachment.html>


More information about the users mailing list