Reverse engineering for opening a shibboleth-protected WEB page from code using a POST call

Mon Sep 11 16:43:48 UTC 2023

General guidance on the flows from a browser (or in your case, an app 
simulating a browser) is here:

https://shibboleth.atlassian.net/wiki/spaces/CONCEPT/pages/928645290/FlowsAndConfig

The important thing is that you store the cookie(s) set when you first 
visit the web form (there will be a Set-Cookie on the redirect to the 
IdP) and play them back when you POST the resulting SAMLResponse value 
returned from the IdP to the SP's AssertionConsumerService endpoint, and 
again when the ACS redirects you to the originally requested page.

On 9/2/2023 10:07 AM, Mauro Minella via users wrote:
>
> ******** HI LEVEL SUMMARY
>
> My goal is to do a POST call from my code to submit a request through 
> a WEB server that requires Shibboleth authentication.
>
> At the moment I am fine to just collect the SAML Request base64 value 
> manually, and authenticate as explained below. So I can collect this 
> base64 value to use for authentication and I can authenticate, but I 
> can’t understand what I should do after authenticating, to finalize my 
> POST call.
>
> ******** DETAILS
>
> When I open the WEB Form on this server, I am redirected to a 
> shibboleth IDP where I insert my username and password, then I add the 
> SMS received, and I am in.
>
> After I am authenticated, I fill this WEB form that correctly returns 
> a result based on the account I am authenticated with. The source code 
> of this WEB page makes a simple POST call with a couple of parameters, 
> where the WEB server is the same, something like 
> https://www.mywebserver.org:443/web/area/find-product 
> <https://www.mywebserver.org:443/web/area/find-product>
>
> Now I need to submit the same form from my code, using a POST call 
> directly, with the same parameters.
>
> However, when I call that page using a POST call with the same 
> parameters, I receive the HTML source code of a WEB page which starts with
>
> ///
>
> <html>
>
> <head>
>
> <title>Shibboleth Authentication Request</title>
>
> </head>
>
> <bodyonload="document.forms[0].submit()">
>
> <h1>Shibboleth Authentication Request</h1>
>
> <scripttype="text/javascript">
>
> *<!--*
>
> document.*write*("<p>You are automatically being redirected to the authentication service. ");
>
> document.*write*("If the browser appears to be hung up after 15-20 seconds, try reloading ");
>
> document.*write*("the page before contacting the technical support staff in charge of the ");
>
> document.*write*("authentication service you are trying to access.</p>");
>
> document.*write*("<h2>Redirecting...</h2>");
>
> //
>
> *-->*
>
> </script>
>
> <noscript>
>
> <p>
>
> <strong>Note:</strong> Since your browser does not support JavaScript, you must press the
>
>             Continue button once to proceed to the authentication service.
>
> </p>
>
> </noscript>
>
> <formmethod="POST"action="https://idpcwrapper.crs.*****.it/PublisherMetadata/SSOService">
>
> <inputtype="hidden"name="RelayState"value="https://www.****.***.***.it/web/**/**-**"/>
>
> <inputtype="hidden"name="SAMLRequest"value="PHNhbWxwOkF1dGhuUmVxdWVzdCB4bWxuczpzYW1scD0idXJuOm9hc2lzOm5h
>
> bWVzOnRjOlNBTUw6Mi4wOnByb3RvY29sIiBBc3NlcnRpb25Db25zdW1lclNl
>
> cnZpY2VVUkw9Imh0dHBzOi8vd3d3LmZhc2NpY29sb3Nhbml0YXJpby5yZWdp
>
> b25lLmxvbWJhcmRpYS5pdC9jaXR0LXNzYy9wcml2YXRlL1NoaWJib2xldGgu
>
> ///
>
> If I save and run this page using my browser, I’m redirected to the 
> same IDP where I can authenticate as usual.
>
> Now I’m not very familiar with this topic, but since I need to 
> complete my initial POST request to read the answer from code, I 
> suppose I need to “capture” the authentication token and insert in my 
> POST request, is that correct? And how could I do this?
>
>

-- 
%%  Christopher A. Bongaarts   %%cab at umn.edu           %%
%%  OIT - Identity Management  %%http://umn.edu/~cab   %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230911/cc42a4d1/attachment.htm>