AWS + ECP?

[Liam Hoekenga]

On Thu, Feb 4, 2016 at 4:43 PM, Brent Putman <putmanb at georgetown.edu> wrote:

> Is that literally the raw output of the aws.plugin.bash with curl -v or
> whatever?  Just making sure b/c it doesn't look like that script indents,
> pretty-prints, etc.  We need to know the unadulterated raw request body
>

My bad.  I like pretty printing.  Here's the un-altered..

<S:Envelope xmlns:S="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"><S:Body><samlp:AuthnRequest
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
AssertionConsumerServiceURL="https://signin.aws.amazon.com/saml"
ID="_B62B96DDC6964A70996F92A385759445" IssueInstant="2016-02-04T21:48:00"
ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Version="2.0"><saml:Issuer
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">urn:amazon:webservices</saml:Issuer><samlp:NameIDPolicy
AllowCreate="1"/><samlp:Scoping><samlp:IDPList><samlp:IDPEntry ProviderID="
https://shib-idp-test.www.umich.edu/idp/shibboleth
"/></samlp:IDPList></samlp:Scoping></samlp:AuthnRequest></S:Body></S:Envelope>


> Also confused about the earlier output that was showing the request with
> 'text/xml'.  My testing shows that curl with "-d" sends  "Content-Type:
> application/x-www-form-urlencoded".  Which jibes with what we previously
> thought.  Wondering if there's differences in various versions of curl.
> Mine is 7.30.0.
>

As downloaded, it does use the wrong content type.  I took a hint from John
Dennis's message and added
-H "Content-Type: text/xml; charset=utf-8"

The unmodified script does use application/x-www-form-urlencoded.  The SOAP
request looks the same...

<S:Envelope xmlns:S="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"><S:Body><samlp:AuthnRequest
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
AssertionConsumerServiceURL="https://signin.aws.amazon.com/saml"
ID="_7E070E8646BE42AF94FF1B2321F46558" IssueInstant="2016-02-04T21:50:23"
ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Version="2.0"><saml:Issuer
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">urn:amazon:webservices</saml:Issuer><samlp:NameIDPolicy
AllowCreate="1"/><samlp:Scoping><samlp:IDPList><samlp:IDPEntry ProviderID="
https://shib-idp-test.www.umich.edu/idp/shibboleth
"/></samlp:IDPList></samlp:Scoping></samlp:AuthnRequest></S:Body></S:Envelope>

The headers look the same, save the content-type...
> POST /idp/profile/SAML2/SOAP/ECP HTTP/1.1
> Host: shib-idp-test.www.umich.edu
> User-Agent: curl/7.46.0
> Accept: */*
> Authorization: Basic *************************
> Content-Length: 735
> Content-Type: application/x-www-form-urlencoded

...and both content types result in the IdP throwing a 500 (tho maybe for
different reasons?)

Liam
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160204/cd66a4c5/attachment-0001.html>