<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">On the Call:</div><div class="">John Bradley</div>William Dennis<div class="">Brian Campbell</div><div class="">Paul Madsen<br class=""><div class=""><br class=""><div class="">We discussed the new features being released in iOS9 and Android.</div><div class=""><br class=""></div><div class="">Apple’s <a href="https://developer.apple.com/library/safari/releasenotes/General/WhatsNewInSafari/Articles/Safari_9.html" style="text-decoration: none;" class=""><span style="font-size: 14.666666666666666px; font-family: Arial; color: rgb(17, 85, 204); text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;" class="">SFSafariViewController</span></a><span class=""> and Android’s </span><span class=""><span style="text-decoration: underline; font-size: 14.666666666666666px; font-family: Arial; color: rgb(17, 85, 204); vertical-align: baseline; white-space: pre-wrap;" class=""><a href="https://developer.chrome.com/multidevice/android/customtabs" style="text-decoration: none;" class="">Chrome Custom Tabs</a></span></span> allow us to use the regular OAuth/Connect code flow to the enterprise or a SAAS.</div><div class="">SAAS can chain existing federation protocols to enterprises to achieve SSO based on session information in the browser.</div><div class=""><br class=""></div><div class="">Apple’s <a href="https://developer.apple.com/library/prerelease/ios/documentation/UserExperience/Conceptual/Handoff/AdoptingHandoff/AdoptingHandoff.html#//apple_ref/doc/uid/TP40014338-CH2-SW10" class="">Universal Links</a> and similar functionality on Android, AS will be able to better guarantee that redirect_uri are returning codes to a legitimate instance of an app.</div><div class=""><br class=""></div><div class="">ACDC will be useful in some use cases, but is no longer required for NAPPS if we are not using a native app with a refresh token to maintain state.</div><div class=""><br class=""></div><div class="">The feeling was that these changes will allow us to do SSO for native apps without requiring as many changes to the existing protocols.</div><div class=""><br class=""></div><div class="">The recommendation on the call was to focus the main document as a best practices guide for doing Native SSO.</div><div class=""><br class=""></div><div class="">We still need a spec to cover session/device termination from a enterprise to a SAAS. (SLO) </div><div class="">We need to document best practices for tenant discovery using <a href="http://accountchooser.com" class="">accountchooser.com</a> or native methods like app restrictions on Android.</div><div class="">We need to cover how to use PKCE for the flows to prevent token theft.</div><div class=""><br class=""></div><div class="">The question for the group is if there is a strong desire to proceed with the original plan to extend OAuth/Connect enable a native TA.</div><div class=""><br class=""></div><div class="">John B.</div><div class="">
<br class=""></div></div></div></body></html>