Shib SP ECP - a few woes

[Cantor, Scott]

On 10/15/13 6:38 PM, "Giovanni Bajo" <rasky at develer.com> wrote:

>To make ecp.py work correctly to the end, I had to make two patches to
>its code; I would like to know whether they make sense or not:
>
>1) When POSTing to the IdP, I had to explicitly add a Content-Type header
>with value "text/xml" to the request, otherwise my IdP wouldn't recognize
>it as a SOAP/ECP request; by default, Python urllib sends Content-Type:
>application/x-www-form-urlencoded, which is surely wrong for a SOAP
>message.

Yes, it is. The specification of the SAML SOAP binding requires SOAP 1.1,
and IIRC the content type for that is text/xml.

>2) The response from my IdP does not include a SOAP:Header within
>SOAP:Envelope. It only contains the SOAP:Body.

I don't think that can be a Shibboleth IdP then, or we have an unreported
bug.

> ecp.py was expecting the SOAP:Header to extract the ACS URL and compare
>it with the one that was mentioned in the SP response, and error out if
>those two URLs don't match.

That's mandatory behavior.

> I've patched out this check. Is this a security issue? Isn't the
>signature enough to validate the IdP response, without having to
>double-check the consistency of the ACS URL?

No.

>PS: This page:
>https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPServiceSSO
>
>doesn't document that <SSO> gets a ECP attribute. It took me a while to
>find out :P

Indirectly it does.

"Other attributes supported include settings specific to various types of
<SessionInitiator>  plugins to alter the behavior of specific protocols."


-- Scott