title: How to use SAML authentication in a mobile application?
body: <p>I'm trying to understand how an saml authentication flow could work in a mobile environment where the client (AngularJS based), api server (Node &amp; passport based), and idp exist on different domains.</p>
  
  <p>From what I've gathered the general practice is to have the server return a 401 to the client if there's no authentication present (i.e. the client didn't include a bearer token in the request). The client understands that a 401 response indicates to open up the login endpoint on the server. When the login endpoint is opened it makes a passport call to the auth provider (which redirects the user to the auth provider's site) and supplies a callback URL. When the user authenticates, the auth provider redirects to the provided callback URL, which allows the server to retrieve information from the auth provider's response and construct a token of some sort (e.g. JWT) that can be used by the client (i.e. included in the headers) when making REST calls to identify itself. </p>
  
  <p>My question is: How does the client get the token from the server? Because we're in a redirect-based authentication flow, I can't just <code>return token</code> from the callback function; that would just display the token in the browser without handing it off of to the client. Does the server just issue a 302 redirect pointing back to the client domain and include the authentication token in a header? Maybe I should not redirect from the client to the server in the first place and instead <code>window.open()</code> and use <code>window.opener.postMessage</code> or is that too old fashioned/mobile-unfriendly?</p>
  
  <p><a href="https://stackoverflow.com/questions/23623200/authenticating-mobile-users-against-saml-idp">This</a> question talks about authentication against a SAML IDP, but I'm interested in getting more details specifically about that last bullet point and how it would work with an AngularJS-based client.</p>
  
  <p>Many examples I've seen online are either a single domain using OAuth/SAML (<a href="https://github.com/gbraad/passport-saml-example/" rel="noreferrer">passport-saml-example</a>), which avoids the issue of having the client exist on a separate domain, or use two domains with basic authentication, which avoids the issue of redirecting to some third party for authentication, but I'm having trouble finding good examples that uses all the bits and pieces I'm trying to work with. </p>
  
  <p><a href="http://matthewtyler.io/handling-oauth2-with-node-js-and-angular-js-passport-to-the-rescue/" rel="noreferrer">This</a> blog post seems very close to what I'm trying to accomplish (see googleSignInCallback) and uses a 302 redirect like I imagined but that solution relies on explicitly knowing the client URL to redirect to, which seems like it could be problematic if I wanted to support multiple client types (i.e. Native applications) in the future.</p>