Testshib and

[Nathan Potter]

Peter,

Thanks for that reply - Sounds like ECP is the thing I am after.

Why I am doing this? I have a large entrenched user base that has a long history of using tools like wget and curl, in addition to some simple GUI based applications that minimally implement support for HTTP Basic authentication. I could dive into the details but let's just say I need to support a legacy infrastructure as new authentication components (aka Shibboleth) get rolled out in front of new and existing resources.

And I was not trying to understand SAML by looking at interactions between HTTP and a Shib instance. I was simply trying to understand where in the chain of interaction things stopped working.

I'll read about ECP and try to understand what I need to do to my SP to get it to work correctly with the testshib.org instance, which as Kevin points out in a subsequent email supports the ECP profile.

Thanks again!

Nathan


On Feb 26, 2015, at 7:55 AM, Peter Schober wrote:

> * Nathan Potter <ndp at opendap.org> [2015-02-26 16:36]:
>> I am not able to use command line curl to retrieve Shibboleth
>> authenticated resources using the .netrc technique in which curl
>> retrieves credentials associated with various authentication
>> endpoints from a local file.
> 
> The SAML profile you're trying to use here (Web Browser SSO) assumes a
> web browser in interactive use, i.e., it was not written for automated
> clients, scripts, etc.
> As such it may contain Java Script (automating the HTTP POST of a
> protocol message from one machine to another) or HTML forms that a
> human subject would know how to fill out and submit.
> (The latter is your concrete problem, the HTML form used for
> authentication doesn't care about a HTTP Authorization request header
> you mave have sent, as this IDP doesn't use HTTP Basic Auth to
> authenticate subjects, but forms based auth. To do any of that
> interoperable and reliably is hard, so don't do that.)
> 
>> Analysis of the HTTP conversation between the idp.testshib.org
>> server and curl shows that curl correctly follows the series of 302
>> redirects issued to it
> 
> If you're trying to learn SAML observing the interactions between a
> HTTP user agent and specific SAML implementations it not
> sufficient. You'd also have to know what the spec says.
> 
> Lacking a description of why you're even doing any of that let me note
> that the SAML specification also defines a profile for usage by
> scripts etc. in the way you seem to require, it's called ECP and both
> the Shibbleth IDP and Shibboleth SP software support it.
> -peter
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

= = =
Nathan Potter                        ndp at opendap.org
OPeNDAP, Inc.                        +1.541.231.3317