WebAuthenticator clarification please

Question

I apologize in advance for the lack of knowledge in this particular area, hence I am asking for directions that might help me to educate myself.

I am adjusting my xamarin app (forms and native droid and iOS) to work in the SSO environment. Naturally, I hoped to be able to use the Xamarin Essential's WebAuthenticator. Apparently, I might not truly understand all the intricacies of how SSO functions. This is not for the social (Google, FB, etc.) logins. It is for an SSO maintained by our client and I am working with them to get the specs and documentation. What I want to understand is what part of this needs to be done in the app and what needs to be done on a server?

My understanding is:

1. in the mobile app I basically call one method of the WebAuthenticator class. The browser will launch redirecting user to the SSO webpage. They enter credentials and the control return to my app. What does it mean for me, what do I get back upon successful login? Some sort of token? What do I do with it later? Currently the app works by calling APIs on our server to retrieve data and execute actions. Users are authenticated against our local database and JWT is used with each api call. How should it all change for the SSO case? Again, the SSO server and directory is hosted by our client, outside of our organization.

2) I believe, based on the limited documentation, there should be something added on our server side that will intercept the call from WebAuthenticator and redirect it to the outside SSO server. The server side of the system is handled by another team within our company that I work with, but I need to be able to direct them in what to do.

Any advice, help, suggestions, direction to learning resources (other than embarrassingly limited Microsoft documentation) is greatly appreciated.

Thank yo so much,
mike

Answer 1

Sorry for the bump. Just hoping to get a little bit more visibility.