Setting up Shibboleth IdP to mock SAML provider

[Brandon Chinn]

Hello all,

I'm trying to set up a Shibboleth IdP server to test our application's
handling of SAML responses. I'm trying to imitate the following workflow:

1. A user logs in via company portal
2. Company portal generates SAML document and redirects user to our
application
3. User passes SAML document to our application, and our application parses
the SAML document, using a pre-configured public key to verify the origin
of the SAML document
4. Our application parses out user information and returns an
authentication token for the user to use for all subsequent interactions
with our application

I'm trying to use the `unicon/shibboleth-idp` Docker image to mock this
company portal that generates a SAML document. My understanding is that
this is an example of an IdP-initiated workflow, or equivalently, an
Unsolicited SSO workflow (SAML2.SSO in
https://wiki.shibboleth.net/confluence/display/IDP30/UnsolicitedSSOConfiguration).
The approach I'm thinking is:

1. Register 'docker.for.mac.internal:8000' as an SP (where 8000 is whatever
port our application is running on in development)
2. Configure password authentication for that SP
3. Upload a file containing users and passwords I'd like to use for
authentication
4. Access '/idp/profile/SAML2/Unsolicited/SSO?providerId=providerOfSP' with
username/password in the request body
    * This request will return a 302 HTTP response containing the SAML
document
    * In development, it would automatically redirect to our application,
which would handle the HTTP response containing the SAML document
    * In testing, we can just extract the SAML document from the HTTP
response and run tests on that

I'm perusing the documentation, but there's a lot of configuration and I'm
not quite sure where to start. I vaguely feel like I'm supposed to edit
relying-party.xml and password-authn-config.xml, but I'm not sure what I'm
supposed to do. Any help would be much appreciated. Thanks!

-- 
Brandon Chinn
LeapYear Technologies (http://leapyear.io)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190605/4450f577/attachment.html>