User login on a website using Shibboleth without a browser

[Benito van der Zander]

> But this seems to need to parse the HTML, too. With my framework I 
> could get this value with pattern matching <input name="SAMLResponse" 
> value="{.}"/>, but I do know if such a server needs any other values

but I do NOT know if such a server needs any other values

sorry


Am 10.05.2018 um 01:17 schrieb Benito van der Zander:
> Hi Joseph,
>
>> What are "Shibboleths"?
>>
>> SAML 2.0 IDPs running the Shibboleth
>> implementation? Or SAML 2.0 IDPs in general?
>
> The website says Shibboleth a dozen times and never mentions SAML in 
> the text, so I guess it is the former.
>
>
>> curl --cookie-jar /tmp/sessioncookies -k -u USERNAME:PASSWORD -o
>   An HTTP authentication? I did not know Shibboleth looks at the headers
>
>> "IDPURL/idp/profile/SAML2/Unsolicited/SSO?providerId=https://$entityID"
>
> And I do not know what an entityID is :/
>
>> cat /tmp/login.html | awk 'match($0, /value=\".*\"\/>/) {print substr($0,
>> RSTART+7, RLENGTH-10)}' | grep -v "Continue" >> /tmp/validsession.data
>
> But this seems to need to parse the HTML, too. With my framework I 
> could get this value with pattern matching <input name="SAMLResponse" 
> value="{.}"/>, but I do know if such a server needs any other values
>
> Cheers,
> Benito
>
>
>
> Am 07.05.2018 um 15:49 schrieb Joseph Fischetti:
>> As others have said, using the ECP endpoint would really be the right way to
>> handle this, but since it doesn't seem like you have any control of the
>> IDP's in question... that's not an option for you.
>>
>> Below is [the relevant code from] a bash script that logs in to a service
>> provider via a specified idp.  A successful login to the SP would produce a
>> cookie for the service provider's entityID in /tmp/sessioncookies.  I use it
>> for monitoring whether or not our shibboleth authentication is working to a
>> given service provider.
>>
>> In short, if you curl the idp initiated login url with valid credentials,
>> you'll get (among other things) the SAML Response, which needs to be
>> formatted and posted to a service provider. No need to find login buttons or
>> parse html with the given solution.
>>
>> There's probably better ways to do this, and your mileage may vary...
>>
>> #log into the auth page using idp initiated login with test credentials,
>> save the cookies to a local file
>> curl --cookie-jar /tmp/sessioncookies -k -u USERNAME:PASSWORD -o
>> /tmp/login.html
>> "IDPURL/idp/profile/SAML2/Unsolicited/SSO?providerId=https://$entityID"
>>
>> #Create a file for the SAML Response, which will be passed to the SP page in
>> a post.  Format is SAMLResponse=XXXXXXXX
>> echo "SAMLResponse=" > /tmp/validsession.data
>> cat /tmp/login.html | awk 'match($0, /value=\".*\"\/>/) {print substr($0,
>> RSTART+7, RLENGTH-10)}' | grep -v "Continue" >> /tmp/validsession.data
>>
>> #Formatting of the response has plus signs, and those need to be replaced
>> with %2B
>> sed -i -e 's/\+/\%2B/g' /tmp/validsession.data
>>
>> #Post the saml response to the SP, use the same cookie jar
>> curl -L -b /tmp/sessioncookies --cookie-jar /tmp/sessioncookies -i -X POST
>> -o /tmp/successtmp.htmlhttps://$entityID/Shibboleth.sso/SAML2/POST
>> --data-binary "@/tmp/validsession.data"
>>
>> Joe Fischetti
>> Linux System Administrator
>> Marist College
>>
>> E-mail:joseph.fischetti at marist.edu
>>
>>
>>
>
>
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180510/8416f6a8/attachment.html>