mobile auth - app sends GET, IdPv3 wants POST

[j sayre]

Greetings, I tried posting this yesterday via the nabble web interface and
the post seems to have not reached the mailing list, at least it's not
showing up in the archive, which already has posts from today.

I'm working with Eric Wedaa on enabling mobile authentication using our
test IdPv3 setup.  I'm authenticating from an android phone and seeing
traffic arrive at the IdP.  Service is IBM Connections Cloud, they're doing
a simple redirect to our IdP rather than having their SP involved.

Our IdP shows the following:

2016-08-17 15:07:39,579 - ERROR
[org.opensaml.profile.action.impl.DecodeMessage:73] - Profile Action
DecodeMessage: Unable to decode incoming request
org.opensaml.messaging.decoder.MessageDecodingException: This message
decoder only supports the HTTP POST method
        at org.opensaml.soap.soap11.decoder.http.impl.HTTPSOAP11Decoder.doDecode(HTTPSOAP11Decoder.java:87)
2016-08-17 15:07:39,584 - WARN
[org.opensaml.profile.action.impl.LogEvent:76] - An error event
occurred while processing the request: UnableToDecode


The logs from the Conn Cloud phone app meanwhile show:

2016/08/16 09:22:50.064	31350	FINE	Unknown Source	31350 GET:
https://idpv3.it.marist.edu/idp/profile/SAML2/SOAP/ECP
...
2016/08/16 09:23:11.960	31350	FINE	Unknown Source	31350 HTTP/1.1 500
Internal Server Error -
https://idpv3.it.marist.edu/idp/profile/SAML2/SOAP/ECP

(the FINE is ignorable gorp from the app showing the trace level)

I'm picking this up brand-new, a previous conversation with the IBM Conn
Cloud folks suggested that if we're really doing http basic auth at the IdP
then a GET should be accepted.  Is the mention of HTTPSOAP11Decoder in the
IdP traces a sign that we have the wrong profile configured for mobile
clients ?

I notice that both the bash and python sample ECP clients at
https://wiki.shibboleth.net/confluence/display/CONCEPT/ECP#ECP-CodeAvailability
do POST.

Pardon newbie ignorance, jumping into this on short notice...
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160818/d312a97e/attachment-0001.html>