Capture sample auth request to IDP?

[Bryan E. Wooten]

Hi all,

We are currently working with a vendor  that usually does IDP initiated login to the SP. They seem open to doing an SP initiated login (woohoo!). We are working with a competent Shib consulting company.

They keep asking this of our consultant:

> Vendor keeps asking for a sample authentication request that the IdP would expect, and the easiest way to send them a sample would be to have an SP generate one and capture that on the IdP. I can setup a test SP, but don't want to spend time doing that if it isn't really necessary. Is there a test SP that you have operational that we could update the metadata for so that it knows about this test IdP? (Assuming that is a SPv2, I could then send a request to its Session Initiation endpoint with the entityID of this test IdP, and that will trigger it to send an authentication request.)

My response is this:

This sample authentication request is problematic for me. I only know 3 ways to capture the actual auth request.

1. Turn off SSL and use something like Wireshark to capture the actual packets between the SP, IDP and client browser. Also requires us to get our test SP back up.
2. Turn up logging on Shib IDP to capture the outbound xml requests. (Is that even possible?)
3. Read the Shib docs and find an example of the SAML requests that are exchanged. (Does that exist?)

Am I completely lost? Or is there a better way?

Cheers,

Bryan

(always under a short schedule!)