ECP SP returns no xml but text/html

[John Dennis]

On 8/7/19 1:47 AM, Tim Miersch wrote:
> I'd like to enable ECP for a shibboleth service point. I am using the 
> (well-known) ecp.sh to test if it works correctly.
> So there is a protected ressource located at /protected/file.txt. If I 
> open this link in my browser I'll get redirected to the SSO of the IdP. 
> After login I'll get redirected back to the file and can access it.

> Upon accessing the file with the ecp.sh script, my SP returns just the 
> same text/html document with the 302-redirect like if I'm opening the 
> link in the browser.

> The script fails because it requires the SP 
> response to be xml. So that tells me that ECP is not working on the SP, 
> because I should get a xml-envelope with content-type 
> application/vnd.paos+xml in return and not a text/html redirect.

No, this is not the ECP flow, the SP does not respond with content type 
application/vnd.paos+xml and an *SOAP* envelope (there is no such thing 
as an xml-envelope). Rather your *ECP client* (in this case the ecp.sh 
script) should send a request to the SP with 2 special HTTP headers:

1. An Accept header indicating acceptance of the MIME type 
"application/vnd.paos+xml"
2. A PAOS header specifying the PAOS version with a value, at minimum,  of
"urn:liberty:paos:2003-08" and a supported service value of
"urn:oasis:names:tc:SAML:2.0:profiles:SSO:ecp".

Those 2 header are what triggers the ECP response in the ECP, if you 
don't send those headers you won't initiate ECP! If you do trigger ECP 
you'll get back a SOAP envelope with an embedded AuthnRequest and the 
content type will be text/xml. Your ECP client will then send forward 
the AuthnRequest to the IdP.

Please refer to the ECP spec to understand the flow:

http://docs.oasis-open.org/security/saml/Post2.0/saml-ecp/v2.0/saml-ecp-v2.0.html

> The ONLY thing I did to enable ECP on the SP is to add ECP=true in the 
> shibboleth2.xml. Is there ANYTHING else required to get it working? (the 
> IdP supports it)
> <SSO ECP="true" entityID="https://login...../shibboleth">
>                  SAML2
> </SSO>
> Best regards
> 
-- 
John Dennis