Org Web Adapter

Editing pages/eng_12761_investigation_of_saml_login_for_mobile.org

:PROPERTIES:
:ID:       ef481268-f37b-43d0-b10b-1a52eb2d3236
:ROAM_ALIASES: ENG-12761
:END:
#+title: ENG-12761 - Investigation of SAML login for Mobile

- source :: https://15five-dev.atlassian.net/browse/ENG-12761

* Resources
** https://15five.quip.com/f5jtAP2l4A2G
** [[https://www.mutuallyhuman.com/blog/choosing-an-sso-strategy-saml-vs-oauth2/][Choosing an SSO Strategy - SAML vs OAuth2]]
- Note taken on [2020-09-16 Wed 14:56]
  Working Around SAML’s HTTP POST Binding

The limitation of the HTTP POST binding for native mobile apps can be worked around. For example, you can use embedded web views, in which you write custom code to watch the entire authentication process. At the very end of the process you scrape the HTML of the page and extract out the SAML token.

A second workaround is to implement a proxy server which can receive the HTTP POST, extract the SAML token, and then make a URL that includes the SAML token (e.g.: “myphotos://authenticate/?SAMLRequest=asdfsdfsdf”) The proxy server could then use an HTTP Redirect to cause the device to open the MyPhotos app. And since the SAML token is a part of the URL the MyPhotos app can extract it, and use that to log in.

A third workaround would be to ignore the specification’s recommendation against using the HTTP Redirect binding. This is very tempting, but it’s hard to shake off the feeling that you’re walking into a mine-field, just hoping you don’t make one wrong step.

Another approach which avoided workarounds altogether is to not rely on SAML, but look at another approach, like OAuth 2.0.

- https://openradar.appspot.com/38999437
- https://stackoverflow.com/questions/54326330/not-able-to-load-redirected-urllogin-url-in-wkwebview
- https://github.com/feedhenry-templates/saml-ios-app/blob/master/saml-ios-app/ViewController.m
- https://stackoverflow.com/questions/35639364/how-does-an-ios-app-receive-a-saml-auth-response

#+begin_src plantuml
iOS -> Safari: [NEW] Open special URL for starting Mobile SAML auth
Safari -> IdP: HTTP POST w/ Auth Request
IdP -> Safari: User sent to login page at IdP
Safari --> IdP: User logs in
IdP -> Safari: [RAT] User authenticated, hijack relay state to `mobile_auth`
Safari -> 15Five: [NEW] POST SAML token for encryption to 15Five app
15Five -> Safari: [NEW] Pass encrypted SAML token 
Safari -> iOS: [NEW] Open deep link to app with encrypted session ID
#+end_src

#+RESULTS:
[[file:/tmp/babel-wEJZ8j/plantuml-wHvpRb.png]]
** Experiment

#+begin_src restclient

GET https://saml-azure.15five.localhost/saml2/mobile/token/
#+end_src