We have a native client application that needs to access a web service that we control. We are investigating securing the web service using SAML. My understanding is that since the client application is a native client (not a browser), we would need to use the SAML Enhanced Client or Proxy Profile. Does the ComponentSpace SAML component support the SAML Enhanced Client or Proxy Profile 2.0? If so, is there example code that can be used as a reference on the proper way to implement the client logic?
We support the protocol messages and bindings used for ECP but it’s not supported through our SAML high-level API and we don’t have any examples.
The reason for this is that ECP is rarely used.
In our experience, most native applications support SAML SSO using the browser-based profile. This means they either invoke a browser instance or use an embedded browser controller.
If you’re looking to support SSO with 3rd party sites, this is the recommended approach for compatibility.
If you control both sides of the SSO, you have the option of using SSO protocols other than SAML that are more suitable for native applications.