<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div>Bryan,</div><div><br><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><div><blockquote type="cite">Vendor keeps asking for a sample authentication request that the IdP would expect, and the easiest way to send them a sample would be to have an SP generate one and capture that on the IdP. I can setup a test SP, but don't want to spend time doing that if it isn't really necessary. Is there a test SP that you have operational that we could update the metadata for so that it knows about this test IdP? (Assuming that is a SPv2, I could then send a request to its Session Initiation endpoint with the entityID of this test IdP, and that will trigger it to send an authentication request.)</blockquote></div></span></blockquote><div><br></div><div>There's always TestShib. It will log outbound authentication requests to a public log and you can upload your metadata.</div><br><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><div>My response is this:<br><br>This sample authentication request is problematic for me. I only know 3 ways to capture the actual auth request.<br><br>1. Turn off SSL and use something like Wireshark to capture the actual packets between the SP, IDP and client browser. Also requires us to get our test SP back up.<br></div></span></blockquote><div><br></div><div>You can just grab the AuthnRequest in the client and decode it.</div><div><br></div><div><a href="https://rnd.feide.no/software/saml_2_0_debugger/">https://rnd.feide.no/software/saml_2_0_debugger/</a></div><br><blockquote type="cite"><div>2. Turn up logging on Shib IDP to capture the outbound xml requests. (Is that even possible?)<br></div></blockquote><div><br></div><div>Outbound? Yes.</div><div><br></div><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><div>3. Read the Shib docs and find an example of the SAML requests that are exchanged. (Does that exist?)<br></div></span></blockquote></div><br><div>We follow the SAML 2.0 specifications, and there isn't much variation or magic sauce in an AuthnRequest.</div><div><br></div><div>Take care,</div><div>Nate.</div></body></html>