question about shibboleth and perl script redirection

[Nate Klingenstein]

Joseph,

> I have a login script that logs into my system and I need to redirect 
> the users to the shibboleth identity service provider.

It's a little unclear what you mean by login script and "identity service provider".  I'm guessing you meant a script that runs on the client's machine that is responsible for authenticating to an IdP.

If I'm right, you want to first decide on the capabilities of the script.  I'd recommend you use the ECP profile if you want to avoid user or client web browser interaction.

https://wiki.shibboleth.net/confluence/display/SHIB2/ECP

> I am floundering in two aspects:
> 
> 1)  In my redirect what do I need to provide in the query string to the 
> provider?

Depends on how the script invokes the authentication process.  If it starts by accessing an SP, then that SP will generate an AuthnRequest in a "SAMLRequest=encodedGoo" query parameter that your client will play to the IdP.

Otherwise, the simplest choice would be:

https://wiki.shibboleth.net/confluence/display/SHIB2/IdPUnsolicitedSSO

> 2)  If I get number 1 correct what will be the return?  a piece of xml 
> that I can slice'n'dice?

Generally, an encrypted piece of XML(an assertion wrapped in a response) that you'll be able to slice'n'dice if you have the right decryption key.  The IdP can disable this encryption if need be.

> Thank you for any and all help - example redirect code would be 
> fantastic.  I just need to know what needs to be sent.

The ECP page links to several great examples, including one in Perl.  The UnsolicitedSSO query string dance is so simple it sort-of precludes example scripts.  You should have no problem with that.

Hope I interpreted everything right, and it gets you a little further along.  Whether or not, we're ready to field more...

Thanks,
Nate.