SP provided username password along with SAMLRequest

[Cantor, Scott]

On 4/24/12 2:23 PM, "Chen, Jack" <jack.chen at twcable.com> wrote:

>Is there any way to "get" the user/pwd POSTed by the SP, and then fill
>those parameters in the form provided by the login.jsp on the Shib IDP?
>Will that work?

How an IdP authenticates people is implementation dependent. You can't
assume anything about how that works. And it's triggered by sending it
SAML requests. You aren't the client, therefore you aren't meant to
deliver the request to the IdP and will not see the login form.

Proxying all traffic to the IdP to spoof it and control it is technically
possible, but functionally pointless and won't lead to any intended uses
of the IdP.

-- Scott