title: Using SAML/OpenID Connect to implement SSO for two websites. How to authenticate Swing client?
body: <p>I am trying to implement SSO for two websites and have currently looked into <code>SAML</code> and <code>OpenID Connect</code>. But I need to authenticate a Swing based desktop client using the same credentials.</p>
  
  <p>I have read about the implicit flow of OpenID Connect but it still needs to open a browser it seems.</p>
  
  <p>SAML Enhanced Client or Proxy profile which seems to solve this kind of problem seems to not be implemented by most idps I have tried out. (Only Shibboleth supports it and the documentation for Shibboleth is not that good).</p>
  
  <ul>
  <li>What kind of solution works for this problem?</li>
  <li>Are there any other SSO mechanisms that support both native and web
  apps?</li>
  <li>Are there workarounds for OpenID Connect/SAML for this kind of
  problem?</li>
  <li>Would it be a good idea to just expose a REST API that authenticates
  the Swing client using the same credentials as the SSO IdP?</li>
  </ul>