Cross-Origin-Authentication with AccessToken for SSO-Usage

Nobody has claimed this yet.

Hi,
over the last days I tried figuring out what's the best way of doing SSO between a mobile native app and a web app. The mobile app is secured with 'resource owner password credentials'-flow and has its own login form.

Our requirement is that the user is able to jump from the native app into other client applications also secured with the same IdP. The other client applications are web applications that should be displayed in In-App-WebViews or maybe Custom-Tabs.

So I found your draft for the Cross-Origin-Authentication and thought it was quite suitable for our use case.

Do you see any problems of doing something similar by sending the Access-Token to the Cross-Origin-Authentication-Endpoint? I know it's not the best way of giving the Access-Token to the useragent but the native app is a confidential client application.

Thanks for some hints or opinions from your side.

Start by reading the draft Cross-Origin-Authentication specification and the issue's proposed flow for passing an access token from a native app to the endpoint. Determine whether this use case is supported and document the security implications or required design changes; the issue does not identify implementation files or tests.

Written by the indexing model from the issue text.