Tableau SSO integration

[Klingenstein, Nate]

Sorry, wrong AuthnRequest.  We have to use a proxy tiered model because they only support one IdP.

It is indeed a signed POST and I'll shut up now.

<saml2p:AuthnRequest xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"
                     AssertionConsumerServiceURL="https://tableau.calstate.edu/wg/saml/SSO/index.html"
                     Destination="https://idp.calstate.edu/idp/profile/SAML2/POST/SSO"
                     ForceAuthn="false"
                     ID="a3297a31i41920c54bjib0ci64hf0i2"
                     IsPassive="false"
                     IssueInstant="2017-07-26T18:32:21.670Z"
                     ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
                     Version="2.0"
                     >
    <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">https://tableau.calstate.edu</saml2:Issuer>
    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <ds:SignedInfo>
            <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
            <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
            <ds:Reference URI="#a3297a31i41920c54bjib0ci64hf0i2">
                <ds:Transforms>
                    <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
                    <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
                </ds:Transforms>
                <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
                <ds:DigestValue>SLrQuOltIvvWGPquyh6+xOcjHMo=</ds:DigestValue>
            </ds:Reference>
        </ds:SignedInfo>
        <ds:SignatureValue>tRT60yeP/VF6RUrF2DXibKjpKw0La46oOE5u/g8r4+cyEtKj7ZV4+hnmH61by0DhqCPukKNe5aEijVGUIF2CJXxxOV9rGMvOHgOdUU9crDIX2t5QDrb93QpERFthdnd6hX7NYoOj4jTwntM+tXxcKafFQxD5nkoWPRcV//YtzpzGN2bG+wqfSBoOSFO46/ZOoyVfQvolCl+keaX6bZtT/7zlov0937rS8G7KxCF7wX0UqwGtxGyOIlsOJ58/ee7IVHjGOucxsnZh6VF9dGmvYaw9HtYQYGGswsGX3OQuTcSygVW+lDd0JGIHhpY3FZHJ9EeQ7WZunOfQ2TEGnt55mQ==</ds:SignatureValue>
        <ds:KeyInfo>
            <ds:X509Data>
                <ds:X509Certificate>MIIFQjCCBCqgAwIBAgIJAOmLW+KSaWnMMA0GCSqGSIb3DQEBCwUAMIHGMQswCQYDVQQGEwJVUzET
MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTG9uZyBCZWFjaDEkMCIGA1UEChMbQ2FsaWZv
cm5pYSBTdGF0ZSBVbml2ZXJzaXR5MSEwHwYDVQQLExhPZmZpY2Ugb2YgdGhlIENoYW5jZWxsb3Ix
HTAbBgNVBAMTFHRhYmxlYXUuY2Fsc3RhdGUuZWR1MSUwIwYJKoZIhvcNAQkBFhZpdHN1cHBvcnRA
Y2Fsc3RhdGUuZWR1MB4XDTE2MTAyNjA2MDQxN1oXDTI2MTAyNDA2MDQxN1owgcYxCzAJBgNVBAYT
AlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpMb25nIEJlYWNoMSQwIgYDVQQKExtD
YWxpZm9ybmlhIFN0YXRlIFVuaXZlcnNpdHkxITAfBgNVBAsTGE9mZmljZSBvZiB0aGUgQ2hhbmNl
bGxvcjEdMBsGA1UEAxMUdGFibGVhdS5jYWxzdGF0ZS5lZHUxJTAjBgkqhkiG9w0BCQEWFml0c3Vw
cG9ydEBjYWxzdGF0ZS5lZHUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDfEtfIm3Ir
bqL3urtKztBih5Z0CM//dcnzJZZqOIwgy3qEpXkrsy11+2Z7EHlv1PL01/Im2IN3fQpJcZAl+VKa
oOuZ50mU5MmZl56MzQg595Zr+SVJ+hMTdqP9/jMGxC2tAXucCOIf4eQkvq6WkTIp5pcbmYcxeZ84
06al2zFHXjmD9b6TFoRdyVffbIMxH4vj84MbELbXjjQguE7C/KZckOsUHCf1xOcTIpitmL7LwGgA
t2KP6+G9OBuGIrAqCUOtj5MLDXpgivGU3DSmbb83cB1zLj3yZg6JRdSUixlfvgAi2q7MmDrHQK4y
RQ4R7PIoCEfzPIX9L/V3pwKXNbBbAgMBAAGjggEvMIIBKzAdBgNVHQ4EFgQUc7/5j+K8lpIVEjUD
rSU3dQpz1y8wgfsGA1UdIwSB8zCB8IAUc7/5j+K8lpIVEjUDrSU3dQpz1y+hgcykgckwgcYxCzAJ
BgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpMb25nIEJlYWNoMSQwIgYD
VQQKExtDYWxpZm9ybmlhIFN0YXRlIFVuaXZlcnNpdHkxITAfBgNVBAsTGE9mZmljZSBvZiB0aGUg
Q2hhbmNlbGxvcjEdMBsGA1UEAxMUdGFibGVhdS5jYWxzdGF0ZS5lZHUxJTAjBgkqhkiG9w0BCQEW
Fml0c3VwcG9ydEBjYWxzdGF0ZS5lZHWCCQDpi1vikmlpzDAMBgNVHRMEBTADAQH/MA0GCSqGSIb3
DQEBCwUAA4IBAQAuryzKHId4I43XIuL3fxp6hYs0D+2iwKwuxsOwrCsyXfPU7fKI3NOcGj3LhFIZ
9ZCrfTYqvOYbZbLKDEtH9pLs1N01BHKRTOzyDqkVZVjSlgyrGz3gWGhjiKp7QSG2lOfp4l7+bmsa
oAthMj62F++V9QRaGGzVxzWqHLlc2Gdz4dWjmEZkQzhx5lJxeIgcs9ZKFbjZllrb+oG+GixINXgE
VMlrdXy10y/NK/eEXWt+ZpOvq3myOhUkI6T13mhIlzyOGEODGKfqLCaxqPPGP8l3EeVeNqufFg6i
VHpWMfADYQFFq5kDpbHArh876K1Dkx37l3Odc+3CsjVtdIn2BqQs</ds:X509Certificate>
            </ds:X509Data>
        </ds:KeyInfo>
    </ds:Signature>
</saml2p:AuthnRequest>