Interacting with a Shibboleth protected website

[Troy Deck]

Hi all,

Please excuse my ignorance about Shibboleth and SAML, I've done some
reading on the subject but I'm still not sure how to accomplish what I'd
like to do. I'm writing a web-based application, for myself and for a few
friends,which will interact with my university's student portal:

https://acadinfo.wustl.edu/

I believe that our single sign on system is based on Shibboleth because of
what I've observed in the signing process, and because the WUSTL CONNECT
website says that's what they're using.

In the past, student-written applications that interact with this site
(e.g. iPhone apps) have procured credentials by simulating a form
submission through the web page and following a bunch of redirects. I have
a solution using Python's version of Mechanize which does this, but it's
pretty ugly and visits no fewer than 7 URLs before logging in. While screen
scraping the actual website is probably unavoidable, I want to know if
there's a better way to authenticate.

I'd also like to know if there's a way that I can avoid storing user
credentials in a recoverable form, perhaps by getting some kind of auth
token and keeping that instead.

My investigations have found the following URL endpoint that's part of the
login process, but I can't get any of the command line shibboleth clients
to work with it:
https://login.wustl.edu/idp/profile/SAML2/POST/SSO

Any tips would be much appreciated :-)

- Troy
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130503/670fdcfe/attachment-0001.html