Capture sample auth request to IDP?

[Nate Klingenstein]

Bryan,

>> Vendor keeps asking for a sample authentication request that the  
>> IdP would expect, and the easiest way to send them a sample would  
>> be to have an SP generate one and capture that on the IdP. I can  
>> setup a test SP, but don't want to spend time doing that if it  
>> isn't really necessary. Is there a test SP that you have  
>> operational that we could update the metadata for so that it knows  
>> about this test IdP? (Assuming that is a SPv2, I could then send a  
>> request to its Session Initiation endpoint with the entityID of  
>> this test IdP, and that will trigger it to send an authentication  
>> request.)

There's always TestShib.  It will log outbound authentication requests  
to a public log and you can upload your metadata.

> My response is this:
>
> This sample authentication request is problematic for me. I only  
> know 3 ways to capture the actual auth request.
>
> 1. Turn off SSL and use something like Wireshark to capture the  
> actual packets between the SP, IDP and client browser. Also requires  
> us to get our test SP back up.

You can just grab the AuthnRequest in the client and decode it.

https://rnd.feide.no/software/saml_2_0_debugger/

> 2. Turn up logging on Shib IDP to capture the outbound xml requests.  
> (Is that even possible?)

Outbound?  Yes.

> 3. Read the Shib docs and find an example of the SAML requests that  
> are exchanged. (Does that exist?)

We follow the SAML 2.0 specifications, and there isn't much variation  
or magic sauce in an AuthnRequest.

Take care,
Nate.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120910/28bb6e57/attachment.html