ENG-12761 - Investigation of SAML login for Mobile

- source :: https://15five-dev.atlassian.net/browse/ENG-12761

Resources

https://15five.quip.com/f5jtAP2l4A2G

[[https://www.mutuallyhuman.com/blog/choosing-an-sso-strategy-saml-vs-oauth2/][Choosing an SSO Strategy - SAML vs OAuth2]]

- Note taken on Wed Sep 16, 202014:56

Working Around SAML’s HTTP POST Binding

The limitation of the HTTP POST binding for native mobile apps can be worked around. For example, you can use embedded web views, in which you write custom code to watch the entire authentication process. At the very end of the process you scrape the HTML of the page and extract out the SAML token.

A second workaround is to implement a proxy server which can receive the HTTP POST, extract the SAML token, and then make a URL that includes the SAML token (e.g.: “myphotos://authenticate/?SAMLRequest=asdfsdfsdf”) The proxy server could then use an HTTP Redirect to cause the device to open the MyPhotos app. And since the SAML token is a part of the URL the MyPhotos app can extract it, and use that to log in.

A third workaround would be to ignore the specification’s recommendation against using the HTTP Redirect binding. This is very tempting, but it’s hard to shake off the feeling that you’re walking into a mine-field, just hoping you don’t make one wrong step.

Another approach which avoided workarounds altogether is to not rely on SAML, but look at another approach, like OAuth 2.0.

- https://openradar.appspot.com/38999437

- https://stackoverflow.com/questions/54326330/not-able-to-load-redirected-urllogin-url-in-wkwebview

- https://github.com/feedhenry-templates/saml-ios-app/blob/master/saml-ios-app/ViewController.m

- https://stackoverflow.com/questions/35639364/how-does-an-ios-app-receive-a-saml-auth-response

#+begin_src plantuml

iOS -> Safari: [NEW] Open special URL for starting Mobile SAML auth

Safari -> IdP: HTTP POST w/ Auth Request

IdP -> Safari: User sent to login page at IdP

Safari --> IdP: User logs in

IdP -> Safari: [RAT] User authenticated, hijack relay state to `mobile_auth`

Safari -> 15Five: [NEW] POST SAML token for encryption to 15Five app