<html>
<head>
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
</head>
<body smarttemplateinserted="true">
<div id="smartTemplate4-template">Hi Joseph,<br>
<br>
<blockquote type="cite">
<pre wrap="">What are "Shibboleths"?
SAML 2.0 IDPs running the Shibboleth
implementation? Or SAML 2.0 IDPs in general?</pre>
</blockquote>
<br>
The website says Shibboleth a dozen times and never mentions SAML
in the text, so I guess it is the former.<br>
<br>
<br>
<p>
<blockquote type="cite">
<pre wrap="">curl --cookie-jar /tmp/sessioncookies -k -u USERNAME:PASSWORD -o</pre>
</blockquote>
</p>
An HTTP authentication? I did not know Shibboleth looks at the
headers<br>
<br>
<blockquote type="cite">
<pre wrap="">"IDPURL/idp/profile/SAML2/Unsolicited/SSO?providerId=<a class="moz-txt-link-freetext" href="https://$entityID">https://$entityID</a>"
</pre>
</blockquote>
<br>
And I do not know what an entityID is :/<br>
<br>
<blockquote type="cite">
<pre wrap="">cat /tmp/login.html | awk 'match($0, /value=\".*\"\/>/) {print substr($0,
RSTART+7, RLENGTH-10)}' | grep -v "Continue" >> /tmp/validsession.data
</pre>
</blockquote>
<br>
But this seems to need to parse the HTML, too. With my framework I
could get this value with pattern matching <input
name="SAMLResponse" value="{.}"/>, but I do know if such a
server needs any other values<br>
<br>
Cheers,<br>
Benito </div>
<br>
<br>
<br>
<div class="moz-cite-prefix">Am 07.05.2018 um 15:49 schrieb Joseph
Fischetti:<br>
</div>
<blockquote type="cite"
cite="mid:SN2PR20MB0720912ADACF4131414123A9EE9B0@SN2PR20MB0720.namprd20.prod.outlook.com">
<pre wrap="">As others have said, using the ECP endpoint would really be the right way to
handle this, but since it doesn't seem like you have any control of the
IDP's in question... that's not an option for you.
Below is [the relevant code from] a bash script that logs in to a service
provider via a specified idp. A successful login to the SP would produce a
cookie for the service provider's entityID in /tmp/sessioncookies. I use it
for monitoring whether or not our shibboleth authentication is working to a
given service provider.
In short, if you curl the idp initiated login url with valid credentials,
you'll get (among other things) the SAML Response, which needs to be
formatted and posted to a service provider. No need to find login buttons or
parse html with the given solution.
There's probably better ways to do this, and your mileage may vary...
#log into the auth page using idp initiated login with test credentials,
save the cookies to a local file
curl --cookie-jar /tmp/sessioncookies -k -u USERNAME:PASSWORD -o
/tmp/login.html
"IDPURL/idp/profile/SAML2/Unsolicited/SSO?providerId=<a class="moz-txt-link-freetext" href="https://$entityID">https://$entityID</a>"
#Create a file for the SAML Response, which will be passed to the SP page in
a post. Format is SAMLResponse=XXXXXXXX
echo "SAMLResponse=" > /tmp/validsession.data
cat /tmp/login.html | awk 'match($0, /value=\".*\"\/>/) {print substr($0,
RSTART+7, RLENGTH-10)}' | grep -v "Continue" >> /tmp/validsession.data
#Formatting of the response has plus signs, and those need to be replaced
with %2B
sed -i -e 's/\+/\%2B/g' /tmp/validsession.data
#Post the saml response to the SP, use the same cookie jar
curl -L -b /tmp/sessioncookies --cookie-jar /tmp/sessioncookies -i -X POST
-o /tmp/successtmp.html <a class="moz-txt-link-freetext" href="https://$entityID/Shibboleth.sso/SAML2/POST">https://$entityID/Shibboleth.sso/SAML2/POST</a>
--data-binary "@/tmp/validsession.data"
Joe Fischetti
Linux System Administrator
Marist College
E-mail: <a class="moz-txt-link-abbreviated" href="mailto:joseph.fischetti@marist.edu">joseph.fischetti@marist.edu</a>
</pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
</blockquote>
<br>
</body>
</html>