How it works
It is basically a carefully crafted SOAP envelope with the RequestSecurityToken against an HTTPS endpoint that supports basic auth.
var rst = "<s:Envelope xmlns:s=\"http://www.w3.org/2003/05/soap-envelope\" xmlns:a=\"http://www.w3.org/2005/08/addressing\">" +
"<s:Header>" +
"<a:Action s:mustUnderstand=\"1\">http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue</a:Action>" +
"<a:To s:mustUnderstand=\"1\">{0}</a:To>" +
"</s:Header>" +
"<s:Body>" +
"<trust:RequestSecurityToken xmlns:trust=\"http://docs.oasis-open.org/ws-sx/ws-trust/200512\">" +
"<wsp:AppliesTo xmlns:wsp=\"http://schemas.xmlsoap.org/ws/2004/09/policy\">" +
"<a:EndpointReference>" +
"<a:Address>{1}</a:Address>" +
"</a:EndpointReference>" +
"</wsp:AppliesTo>" +
"<trust:KeyType>" + keyType + "</trust:KeyType>" +
"<trust:RequestType>http://docs.oasis-open.org/ws-sx/ws-trust/200512/Issue</trust:RequestType>" +
"</trust:RequestSecurityToken>" +
"</s:Body>" +
"</s:Envelope>";
$.ajax({
url: this.stsUrl,
data: body,
type: 'POST',
beforeSend: function(xhr) {
xhr.setRequestHeader("Authorization", "Basic " + Base64.encode(username + ":" + pass));
xhr.setRequestHeader("Content-Type", "application/soap+xml; charset=utf-8");
},
timeout: 5000,
dataType: 'xml',
success: function(data, status){
callback.success(data);
},
error: function(qXHR, textStatus, errorThrown){
callback.error(qXHR)
}
});
This was tested from PhoneGap / XCode against ADFS with the usernamebasictransport endpoint turned on.
IMPORTANT: in order to make external http requests you will have to edit the PhoneGap.plist and include the host name of your STS in the ExternalHosts list.
