ECP SP returns no xml but text/html

[Brent Putman]

On 8/7/19 3:14 PM, Cantor, Scott wrote:
> On 8/7/19, 3:03 PM, "John Dennis" <jdennis at redhat.com> wrote:
>
>> I don't think that's true, it does the whole ECP flow beginning with the 
>> request for the resource from the SP. 
> There are lots of scripts, they're all different. I have one in Perl that's IdP only and just mocks up requests, but I know of the others you're thinking of also.


And not to overlook the obvious in the OP's original question:


> So there is a protected ressource located at /protected/file.txt. ...
>  
> Upon accessing the file with the ecp.sh script, my SP returns just
> the same text/html document with the 302-redirect like if I'm opening
> the link in the browser. 


I believe that is in fact the expected behavior on a successful full
ECP exchange. If the ECP flow has happened successfully:

    - ECP received the SAML AuthnRequest from the SP via the PAOS binding
    - ECP sent the SAML AuthnRequest to IdP and successfully authNed
    - ECP received SAML Response back from IdP
    - ECP sent the SAML Response to the SP via the PAOS binding
    - SP validated and accepted the SAML Response+Assertion
    - any SP authZ rules were satisfied

then the expected next step is the SP's plain old HTTP response back to
the ECP for the original resource request - in our SP I think that will
generally really be a 3xx redirect to that resource (e.g.
/protected/file.txt).

So we don't know if all of that flow is actually happening for the OP -
we'd need logging etc from any or all of the 3 actors - but what the OP
said was happening is consistent with the expected successful final
response from the SP.

The only thing inconsistent with all of that is the statement that the
ecp.sh is complaining (at some point, unclear where) about receiving
HTML rather than XML.  I think the most likely explanations are:

1) the flow is happening correctly, the SP is successfully responding
correctly and this ecp.sh script is just broken.

2) the SP is misconfigured, the /protected/file.txt is actually not
protected by the SP, and so for the initial ECP request the web server
is just returning a plain HTTP response with the content.  The ecp.sh
is correctly complaining that it's not the expected SAML AuthnRequest
conveyed via the PAOS binding.

For those cases the OP needs to figure out which of those it is (or
something else, if I've overlooked some case).

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190807/e5d3fb63/attachment.html>