SOAP client to test samlValidate ?

[Marvin Addison]

On Thu, Apr 7, 2016 at 1:27 PM Brent Putman <putmanb at georgetown.edu> wrote:

> is the payload a SAML protocol request/response, or something CAS-specific?
>

The intent was to be compliant with the SAML 1.1 spec. I believe it's based
on the browser artifact profile over the HTTP-POST binding. Request
messages look like this:

2016-04-07 13:38:10,962 - DEBUG [PROTOCOL_MESSAGE:?] -
<?xml version="1.0" encoding="UTF-8"?>
<soap:Envelope xmlns="urn:oasis:names:tc:SAML:1.0:protocol"
            xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
    <soap:Header/>
    <soap:Body>
        <Request
            IssueInstant="2016-04-07T17:38:10Z" MajorVersion="1"
            MinorVersion="1" RequestID="_ce9d0e0137eccf5468704bd8cb7a0f86">

<AssertionArtifact>ST-1460050690923-sMrhErd1uhuuKUenR7DRIBLbi</AssertionArtifact>
        </Request>
    </soap:Body>
</soap:Envelope>

Note the CAS protocol ticket appears as the artifact. The TARGET parameter
is required; it should convey the URL of the service that requested the
ticket:

198.82.160.148 - - [07/Apr/2016:13:38:10 -0400] "POST
/profile/cas/samlValidate?TARGET=https%3A%2F%2Fcas-sp.middleware.vt.edu%3A74
43%2Fsaml11%2Fsecure%2F&renew=true HTTP/1.1" 200 10758 "-" "Java/1.7.0_21"

Are there any SOAP header processing requirements (outbound/request and
> inbound/response)?
>

None.


> Does it need to do client TLS?
>

No.


> Or are there a message-level signatures?
>

Nope. That's the biggest difference with the CAS use of SAML; no
message-level security whatever.

Please let me know if you need further information to build something.

M
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20160407/23c57575/attachment.html>