An Identity Provider may need to know if the user agent is executed in an app about technical-framework HOT 2 CLOSED

There is really two different cases we are discussing here:

1. A Service Provider that is a mobile app and uses the embedded browser for SAML-authentication.
2. A "normal" web service SP that may be executed from within an app, for example Facebook. This actually happened when Pensionsmyndigheten launched a campaign on Facebook and users followed links from within the Facebook-app. The autostart function of the BankID app failed in those cases since the Facebook-app has not whitelisted the BankID app (obviously).

from technical-framework.

For (1) above we could argue that the app should make sure to whitelist the BankID-app so that autostart of the BankID-app works. But what about the BankID Redirect-parameter? How should the IdP know the URI for the SP app? Manual handling is the only generic way to go.

For (2) above we already have recommendations in section 3.2 talking about autostart when a non-default browser has been detected, and that should cover the case.

So. We will close this issue.

from technical-framework.