Testshib and

[Peter Schober]

* Nathan Potter <ndp at opendap.org> [2015-02-26 16:36]:
> I am not able to use command line curl to retrieve Shibboleth
> authenticated resources using the .netrc technique in which curl
> retrieves credentials associated with various authentication
> endpoints from a local file.

The SAML profile you're trying to use here (Web Browser SSO) assumes a
web browser in interactive use, i.e., it was not written for automated
clients, scripts, etc.
As such it may contain Java Script (automating the HTTP POST of a
protocol message from one machine to another) or HTML forms that a
human subject would know how to fill out and submit.
(The latter is your concrete problem, the HTML form used for
authentication doesn't care about a HTTP Authorization request header
you mave have sent, as this IDP doesn't use HTTP Basic Auth to
authenticate subjects, but forms based auth. To do any of that
interoperable and reliably is hard, so don't do that.)

> Analysis of the HTTP conversation between the idp.testshib.org
> server and curl shows that curl correctly follows the series of 302
> redirects issued to it

If you're trying to learn SAML observing the interactions between a
HTTP user agent and specific SAML implementations it not
sufficient. You'd also have to know what the spec says.

Lacking a description of why you're even doing any of that let me note
that the SAML specification also defines a profile for usage by
scripts etc. in the way you seem to require, it's called ECP and both
the Shibbleth IDP and Shibboleth SP software support it.
-peter