Manually Generate a SAML Response

[Klingenstein, Nate]

An AuthnRequest is totally unsigned XML in most cases so you can tinker with it to your heart's content.  You'll need to use a base 64 tool if you are using Redirect.  A web search should reveal some options.

You wouldn't be able to insert trusted references or anything through this, of course, so it might not satisfy your needs depending on the validation that they're doing.

If it's signed, then you can hijack their metadata and change their key pair, but otherwise you can't spoof signed requests by their very design.

Between asking them to issue a fresh one and fiddling with it, you should be able to verify something.  It's not a full end to end test, but it would be closer.

Semt frim mt iPone

> On Jun 20, 2017, at 1:25 PM, Michael Dahlberg <olgamirth at gmail.com> wrote:
> 
> I have what I think is a unique problem.  I'm working with a SP that wants to validate our IdP.  In so doing, they want us to POST a web document to their test site which contains three fields: a base64 encoded SAML2 response, the base64 encoded version of our Shibboleth X509 cert, and our entityId.
> 
> Normally, if I wanted the SAML2 response that is redirected to the SP, I'd just look in the debug logs for that particular SP after a failed/successful login attempt.  Unfortunately, this requires that I submit the request (using an unsolicited login through our IdP).  By actually submitting the request to their test site using this POST proceedure, the SubjectConfirmation needs to be valid, the time parameters need to be valid, the Reference needs to be valid (which I assume means I can't resubmit the request that I used to originally create the SAML2 response).
> 
> So, is there a way that I can manually generate a SAML2 response outside of a normal web login attempt, that I can then base64 encode and submit by POSTing it to their test site?
> 
> Thanks,
> Mike
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net