Handling HTTP 302 Moved Temporary redirections

[Marek Denis]

Hello,

I am still playing with the SAML extended with ECP and my Python
client and  noticed one thing that I don't really understand. I am
using mod_shib + shibd at the SP side, and testshib.org as my current
IdP (thanks Kevin!).

My protected URL I need to access is GET
https://openstack4.local/v3/OS-FEDERATION/identity_providers/testshib/protocols/saml2/auth
I can get my desired repsonse when using referential Python client, so
I know it works. I did rewrite it to utilize python-requestslibrary.
It also works.

However when I was tracing the HTTP requests sequences there is one
step I would like to understand. After I authenticate against IdP and
get my SAML2 assertion I should send it back to the consumer url. In
my case this is https://openstack4.local/Shibboleth.sso/SAML2/ECP . So
I issue HTTP POST request with SAML2 assertion in the requests's body,
with approprite headers and so one. What I get in return is HTTP 302
status code redirecting me to the initial protected resource,
https://openstack4.local/v3/OS-FEDERATION/identity_providers/testshib/protocols/saml2/auth
Is the redirection an effect, that the user is now authenticated, the
session is created and the user should now enter the protected URL?
What I found weird was the fact that while I was hitting the URL after
I got the HTTP 302, the HTTP method didn't matter. What mattered was
whether the request's body was empty or not. I want to confirm if my
reasoning behing HTTP 302 (why is it happening and why re-sending body
makes the server fail), since I think HTTP specs accept  resending
everything to the new location, after HTTP 302. And this means I
should preserve method request (POST), as well as re-send the body to
the https://openstack4.local/v3/OS-FEDERATION/identity_providers/testshib/protocols/saml2/auth
which in that case causes my server behind protected url to fail.

Thanks for the clarification.
-- 
Marek Denis