Testshib and

[Nathan Potter]

Greetings,

I am new to this list. Please forgive me if this is a well covered topic. I spent some time searching the archive and was unable to locate a thread that addressed my question.

I am not able to use command line curl to retrieve Shibboleth authenticated resources using the .netrc technique in which curl retrieves credentials associated with various authentication endpoints from a local file. I have had success with this against both LDAP and OAuth2 authenticated resources.

Analysis of the HTTP conversation between the idp.testshib.org server and curl shows that curl correctly follows the series of 302 redirects issued to it, first by the Apache service bound to my origin server and then from the idp.testshib.org server. In every request to the idp.testshib.org server the curl client correctly offers the credentials via the HTTP Authorization header:

0000: GET /idp/Authn/UserPassword HTTP/1.1
0026: Authorization: Basic bXlzZWxmOm15c2VsZg==
0051: User-Agent: curl/7.21.4 (universal-apple-darwin11.0) libcurl/7.2
0091: 1.4 OpenSSL/0.9.8z zlib/1.2.5
00b0: Host: idp.testshib.org
00c8: Accept: */*
00d5: Cookie: _idp_authn_lc_key=efbb6e2a9d893b47fb802ed575329ce69c101b
0115: 3ea8beb6744fab64fc406c358f; JSESSIONID=5A1731EDE00613B13803968CF
0155: AF06284
015e: 

But the idp.testshib.org Shibboleth system doesn't respond to them. Is this simply a configuration issue on the Shibboleth IdP end, or is it that the Shibboleth protocol specifically forbids accepting credentials via HTTP Authorization headers?


Thanks for your time,


Nathan



= = =
Nathan Potter                        ndp at opendap dot org
OPeNDAP, Inc.