Automated Shib login for monitoring

[Tom Scavo]

On Thu, Feb 12, 2015 at 3:57 PM, Wessel, Keith <kwessel at illinois.edu> wrote:
>
> I've been tasked with collecting performance and availability numbers for our IDP nodes which gave me reason to do something I've been wanting to do for a while: write a better monitor for Shib than just using the status URL.
>
> I started my work by writing a Perl script that, using LWP, hits an SP's login URL and goes through the IDP login process. It's not pretty, but it almost works.

I have a bash script that does pretty much the same thing. Roland
Hedberg has some tools as well. You should really take a look at
Roland's stuff if you haven't already.

> However, depending on an SP to initiate the process adds some variables that I'd rather avoid: more latency and depending on the SP to be up, just to name a couple.
>
> I'd like to actually have my code generate the SAML request and process the response, making sure it's getting back valid attributes.
>
> First, does this seem like a sane line of thinking?

Sure, you can do that, but why not just let the SP do the work? The
reasons you mention above don't seem to justify the added work.

> Secondly, are there any good resources out there for knowing exactly what I'm going to need to do for request and response handling short of reading the SP source code?

I'm not sure what you're asking. You don't need to do a complete round
trip (SP->IdP->SP). Depending on what you're trying to do, it should
be good enough to ensure the login page is returned to the browser.
Not sure why you'd need to go any further than that.

Anyway, I'm interested in your work, so please provide updates (and
maybe source code at some point :)

Thanks,

Tom