Issue / Bug with Unsolicited SSO after Update from IdP 3.3.1 to 3.4.3

[Martin Lunze]

Hi Scott, hi Tom,

thanks for your fast response.

I have used this call for many years to manually check only the 
reachability (and "functionality") of the login-page after restarting 
tomcat on the commandline.
This is only a fast and dirty manually check, so no worry. I do not use 
unsolicited sso or curl for any other operations.

To automatically check the complete functionality of the login-process 
and the attribute-consent i have written a python script for our 
monitoring-system which handles cookies and goes throw all steps until 
reaching the service provider.

Changing the command the following saved the problem:

> curl -k -c /tmp/sh_co.txt -L 
> https://localhost/idp/profile/SAML2/Unsolicited/SSO?providerId=https://e5.onthehub.com

Seems for me that the idp fails with the new version (3.4.3) if curl did 
not handle cookies.
With the old version (3.3.1) it was not necessary to use the 
"--cookie-jar" option of curl.

So, sorry for the noise.
Have a nice week.

Regards
Martin

Am 12.03.19 um 15:36 schrieb Tom Scavo:
> On Tue, Mar 12, 2019 at 9:11 AM Cantor, Scott <cantor.2 at osu.edu> wrote:
>> On 3/12/19, 7:02 AM, "users on behalf of Martin Lunze" <users-bounces at shibboleth.net on behalf of martin.lunze at tu-dresden.de> wrote:
>>
>>> My test-call looks like this:
>> You can't use curl like that unless you're also handling cookies with it. That isn't new, and has nothing to do with the upgrade. All it will do is redirect into a flow, fail to send back JSESSIONID, and trigger the exact error you got.
> Here's a cookbook how to use curl to obtain a SAML2 response from a
> Shibboleth IdP. Last time I tried this, four round trips were
> required.
>
> https://spaces.at.internet2.edu/x/8QKRAg
>
> HTH,
>
> Tom

-- 
Martin Lunze
IT-Systemadministrator

Technische Universität Dresden
Zentrum für Informationsdienste und Hochleistungsrechnen (ZIH)
Operative Prozesse und Systeme (OPS)
01062 Dresden

Tel.: +49 (351) 463-35881
E-Mail: martin.lunze at tu-dresden.de


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5742 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://shibboleth.net/pipermail/users/attachments/20190313/05043471/attachment.p7s>