Shib SP ECP - a few woes

[Giovanni Bajo]

Hello,

I'm working on deploying SAML in our infrastructure. As a first step, I deployed Shib as a SP for most services using Web Browser SSO, with mod_shib in Apache; that worked correctly. I am now working on configuring ECP for a few clients/services that require it.

The clients that need to talk via ECP to the services are mostly written in Python; I've thus started prototyping ECP implementation using ecp.py (found here: https://wiki.shibboleth.net/confluence/display/SHIB2/ECP).

To make ecp.py work correctly to the end, I had to make two patches to its code; I would like to know whether they make sense or not:

1) When POSTing to the IdP, I had to explicitly add a Content-Type header with value "text/xml" to the request, otherwise my IdP wouldn't recognize it as a SOAP/ECP request; by default, Python urllib sends Content-Type: application/x-www-form-urlencoded, which is surely wrong for a SOAP message.

2) The response from my IdP does not include a SOAP:Header within SOAP:Envelope. It only contains the SOAP:Body. ecp.py was expecting the SOAP:Header to extract the ACS URL and compare it with the one that was mentioned in the SP response, and error out if those two URLs don't match. I've patched out this check. Is this a security issue? Isn't the signature enough to validate the IdP response, without having to double-check the consistency of the ACS URL?

Thanks in advance for your help!

PS: This page:
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPServiceSSO

doesn't document that <SSO> gets a ECP attribute. It took me a while to find out :P
-- 
Giovanni Bajo   ::  rasky at develer.com
Develer S.r.l.  ::  http://www.develer.com

My Blog: http://giovanni.bajo.it





-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4207 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20131016/76800b48/attachment.bin