Questions Regarding Shibboleth and Salesforce

[Peter Schober]

* Juan Quintanilla <jquin014 at fiu.edu> [2012-06-22 21:36]:
> Also in the configuration process for Salesforce it asks for you to
> provide a saml assertion to validate, does anyone have way to obtain
> or generate this assertion from shibboleth.

You could grab it from the browser during transit (if you're also
interested in the attribute statement that obviously means you'll need
to push attributes over the browser, as is the default for SAML2
WebSSO), e.g. using Olav's "SAML tracer" extension for Mozilla Firefox.

Or disable JavaScript in any webbrowser and grab the base64-encoded
HTML form content form the page source when told to "press a button to
continue" (or whatever the exact wording is). Then base64-decode it
with any tool of your liking (GNU base64, Perl, some web site, etc.)

If an encrypted attribute statement is a problem for this "validation"
you'll probably have to disable encryption anyway, but you can get the
assertion before encryption from the IdP's process log when setting
edu.internet2.middleware.shibboleth (or more specifically
edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler )
to DEBUG.
-peter