User login on a website using Shibboleth without a browser

[Benito van der Zander]

Hi Joseph,

> What are "Shibboleths"?
>
> SAML 2.0 IDPs running the Shibboleth
> implementation? Or SAML 2.0 IDPs in general?

The website says Shibboleth a dozen times and never mentions SAML in the 
text, so I guess it is the former.


> curl --cookie-jar /tmp/sessioncookies -k -u USERNAME:PASSWORD -o

An HTTP authentication? I did not know Shibboleth looks at the headers

> "IDPURL/idp/profile/SAML2/Unsolicited/SSO?providerId=https://$entityID"

And I do not know what an entityID is :/

> cat /tmp/login.html | awk 'match($0, /value=\".*\"\/>/) {print substr($0,
> RSTART+7, RLENGTH-10)}' | grep -v "Continue" >> /tmp/validsession.data

But this seems to need to parse the HTML, too. With my framework I could 
get this value with pattern matching <input name="SAMLResponse" 
value="{.}"/>, but I do know if such a server needs any other values

Cheers,
Benito



Am 07.05.2018 um 15:49 schrieb Joseph Fischetti:
> As others have said, using the ECP endpoint would really be the right way to
> handle this, but since it doesn't seem like you have any control of the
> IDP's in question... that's not an option for you.
>
> Below is [the relevant code from] a bash script that logs in to a service
> provider via a specified idp.  A successful login to the SP would produce a
> cookie for the service provider's entityID in /tmp/sessioncookies.  I use it
> for monitoring whether or not our shibboleth authentication is working to a
> given service provider.
>
> In short, if you curl the idp initiated login url with valid credentials,
> you'll get (among other things) the SAML Response, which needs to be
> formatted and posted to a service provider. No need to find login buttons or
> parse html with the given solution.
>
> There's probably better ways to do this, and your mileage may vary...
>
> #log into the auth page using idp initiated login with test credentials,
> save the cookies to a local file
> curl --cookie-jar /tmp/sessioncookies -k -u USERNAME:PASSWORD -o
> /tmp/login.html
> "IDPURL/idp/profile/SAML2/Unsolicited/SSO?providerId=https://$entityID"
>
> #Create a file for the SAML Response, which will be passed to the SP page in
> a post.  Format is SAMLResponse=XXXXXXXX
> echo "SAMLResponse=" > /tmp/validsession.data
> cat /tmp/login.html | awk 'match($0, /value=\".*\"\/>/) {print substr($0,
> RSTART+7, RLENGTH-10)}' | grep -v "Continue" >> /tmp/validsession.data
>
> #Formatting of the response has plus signs, and those need to be replaced
> with %2B
> sed -i -e 's/\+/\%2B/g' /tmp/validsession.data
>
> #Post the saml response to the SP, use the same cookie jar
> curl -L -b /tmp/sessioncookies --cookie-jar /tmp/sessioncookies -i -X POST
> -o /tmp/successtmp.html https://$entityID/Shibboleth.sso/SAML2/POST
> --data-binary "@/tmp/validsession.data"
>
> Joe Fischetti
> Linux System Administrator
> Marist College
>
> E-mail: joseph.fischetti at marist.edu
>
>
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180510/309513a4/attachment.html>