# SSO / SAML authentication using Ignition Perspective APK on Android mobile

**URL:** <https://forum.inductiveautomation.com/t/sso-saml-authentication-using-ignition-perspective-apk-on-android-mobile/57569>\
**Category:** Ignition\
**Tags:** ignition81, perspective\
**Created:** [March 24, 2022, 12:33am UTC](https://forum.inductiveautomation.com/t/sso-saml-authentication-using-ignition-perspective-apk-on-android-mobile/57569 "2022-03-24T00:33:39Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jsorlie](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jsorlie/32/3645_2.png) [@jsorlie](https://forum.inductiveautomation.com/u/jsorlie)\
**Post date:** [March 24, 2022, 12:33am UTC](https://forum.inductiveautomation.com/t/sso-saml-authentication-using-ignition-perspective-apk-on-android-mobile/57569/1 "2022-03-24T00:33:39Z")

</div>

**Does anyone have SAML / SSO working with the Ignition Perspective APK ?**

We are setting up internal MDM deployment of the

- [extra-material](https://inductiveautomation.com/downloads/extra-material) / [Ignition Perspective Android App - APK](https://files.inductiveautomation.com/release/perspective/android/Ignition_Perspective_1.0.3.apk)

After getting internal endpoints (i.e. gateways) configured in the managed-devices VPN tunnel, the managed-app (downloaded APK from the managed Play) works to launch internal Perspective projects. _ **When we try to get SSO / SAML authentication to work using the managed-app APK, we get a time-out error.** _

I suspected that we might be missing another internal endpoint in the VPN tunnel; unfortunately I have not found a way to trace the SAML/SSO network API-exchange as one can using Chrome browser’s F12-developer tools. The API-handshaking sets up the authenticated session. As best I can tell, Android’s [System Tracing](https://developer.android.com/topic/performance/tracing/on-device) dev-tool [does not yet support network information](https://github.com/google/perfetto/issues/156) in the [Perfetto](https://ui.perfetto.dev/) system traces.

I say “suspected” because if, instead of using the managed-APK, I access a gateway and/or perspective project via the managed-app (VMware’s) web browser, the SAML / SSO api-exchange executes to completion yielding a valid authenticated session. Because this pathway is utilizing the same VPN tunnel, the issue of missing endpoints would seem to be falsified.

 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/6/5/65f7f547efa6123d13659f11f5baa26dc3f1c095.jpeg)

Punting this question here since I’m about out of ideas of how to advance.

I don’t see anything since release [0.97.2](https://forum.inductiveautomation.com/t/ignition-perspective-mobile-app-changelogs/37685/7) in the [APK’s change-log](https://forum.inductiveautomation.com/t/ignition-perspective-mobile-app-changelogs/) regarding SSO or SAML.

---

<div class="post-metadata">

**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\
**Post date:** [March 28, 2022, 6:52pm UTC](https://forum.inductiveautomation.com/t/sso-saml-authentication-using-ignition-perspective-apk-on-android-mobile/57569/2 "2022-03-28T18:52:54Z")

</div>

Hi @jsorlie -

Your best bet will be reaching out to support to troubleshoot this. We’d likely need to understand the details around your network topology, how the perspective app connects to the Gateway, and how the VPN and this VMWare browser come into the equation before we can help troubleshoot. Someone will likely need to walk through the redirects to see where things are breaking down…

---

<div class="post-metadata">

**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\
**Post date:** [March 28, 2022, 7:02pm UTC](https://forum.inductiveautomation.com/t/sso-saml-authentication-using-ignition-perspective-apk-on-android-mobile/57569/3 "2022-03-28T19:02:53Z")

</div>

Before reaching out to support, take a look at this: [[BUG-13715,13982] Perspective App - #19 by mrojas](https://forum.inductiveautomation.com/t/bug-13715-13982-perspective-app/24648/19)

If there are any reverse proxies or other middleware between the Perspective App and the Gateway, make sure that custom HTTP request headers are not filtered out before forwarding to the Gateway. I believe these include:

- client\_timezone
- device\_id
- device\_type
- version\_code
- perspective-session-id