AWS + ECP?

[Liam Hoekenga]

We're getting pulled in to some AWS work by our virtualization group.
They've been scouring google for command line tools, and would rather not
invest in a lot of local development.  One of said tools was written to
authenticate to AWS against a Shibboleth IdP using ECP (
https://github.com/aziz/dotfiles/blob/master/bash/plugins/aws.plugin.bash)

I'm not sure how it would even work because the script specifies the
HTTP-POST binding.. and the AWS metadata doesn't have a POAS (ECP) binding
/ endpoint.  If we try it using the POST binding, the IDP complains
(unsurprisingly?):

2016-02-04 15:26:26,255 - ERROR
[net.shibboleth.utilities.java.support.xml.BasicParserPool:50] -
141.213.171.204 - XML Parsing Error
org.xml.sax.SAXParseException: Premature end of file.
at
com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.createSAXParseException(ErrorHandlerWrapper.java:203)
2016-02-04 15:26:26,257 - ERROR
[org.opensaml.messaging.decoder.servlet.BaseHttpServletRequestXMLMessageDecoder:151]
- 141.213.171.204 - Error unmarshalling message from input stream
net.shibboleth.utilities.java.support.xml.XMLParserException: Unable to
parse inputstream, it contained invalid XML
...
2016-02-04 15:26:26,266 - DEBUG
[org.opensaml.saml.saml2.binding.impl.AddECPResponseHeaderHandler:60] -
141.213.171.204 - Message Handler:  No ACS location available in message
context
2016-02-04 15:26:26,266 - DEBUG
[org.opensaml.saml.common.binding.impl.AddChannelBindingsHeaderHandler:83]
- 141.213.171.204 - Message Handler:  No ChannelBindings to add, nothing to
do


/Should/ this work?  Seems like it shouldn't... IdP ECP endpoint + SP
HTTP-POST endpoint?

Does anyone have command line tools for interacting with shibboleth
authenticated AWS that they'd recommend or point me at?

thanks!

Liam
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160204/217934b9/attachment-0001.html>