Interacting with a Shibboleth protected website

[Cantor, Scott]

> Please excuse my ignorance about Shibboleth and SAML, I've done some
> reading on the subject but I'm still not sure how to accomplish what I'd like to
> do. I'm writing a web-based application, for myself and for a few
> friends,which will interact with my university's student portal:

I think the people who answered you assumed you were writing the server, but I think you mean you're writing a mobile client.

> In the past, student-written applications that interact with this site (e.g.
> iPhone apps) have procured credentials by simulating a form submission
> through the web page and following a bunch of redirects. I have a solution
> using Python's version of Mechanize which does this, but it's pretty ugly and
> visits no fewer than 7 URLs before logging in. While screen scraping the actual
> website is probably unavoidable, I want to know if there's a better way to
> authenticate.

Your IdP needs to support the ECP profile of SAML for non-browser clients and your application has to wrap its HTTP client layer with an ECP client. The actual authentication is usually basic-auth.

> I'd also like to know if there's a way that I can avoid storing user credentials in
> a recoverable form, perhaps by getting some kind of auth token and keeping
> that instead.

That would be up to the IdP deployer to implement as some kind of customization. That's essentially a user authentication question. If they don't offer support for something other than real-time credential use, then you would need to collect the credentials each time. Storing them is likely to be against most campus policies, but that varies by university.

> My investigations have found the following URL endpoint that's part of the
> login process, but I can't get any of the command line shibboleth clients to
> work with it:
> https://login.wustl.edu/idp/profile/SAML2/POST/SSO

That is a browser endpoint. If you're not a browser, it's not meant for you.

-- Scott