<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p><br>
</p>
<div class="moz-cite-prefix">On 8/7/19 3:14 PM, Cantor, Scott wrote:<br>
</div>
<blockquote type="cite"
cite="mid:6F6D20D0-BED7-42A0-A125-72158F1838C4@osu.edu">
<pre class="moz-quote-pre" wrap="">On 8/7/19, 3:03 PM, "John Dennis" <a class="moz-txt-link-rfc2396E" href="mailto:jdennis@redhat.com"><jdennis@redhat.com></a> wrote:
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">I don't think that's true, it does the whole ECP flow beginning with the
request for the resource from the SP.
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
There are lots of scripts, they're all different. I have one in Perl that's IdP only and just mocks up requests, but I know of the others you're thinking of also.
</pre>
</blockquote>
<p><br>
</p>
<p>And not to overlook the obvious in the OP's original question:</p>
<p><br>
</p>
<p>
<blockquote type="cite">
<div>So there is a protected ressource located at
/protected/file.txt. ...</div>
<div> </div>
Upon accessing the file with the ecp.sh script, my SP returns
just the same text/html document with the 302-redirect like if
I'm opening the link in the browser. </blockquote>
</p>
<p><br>
</p>
<p>I believe that is in fact the expected behavior on a successful
full ECP exchange. If the ECP flow has happened successfully:</p>
<p> - ECP received the SAML AuthnRequest from the SP via the PAOS
binding<br>
- ECP sent the SAML AuthnRequest to IdP and successfully
authNed<br>
- ECP received SAML Response back from IdP<br>
- ECP sent the SAML Response to the SP via the PAOS binding<br>
- SP validated and accepted the SAML Response+Assertion<br>
- any SP authZ rules were satisfied</p>
<p>then the expected next step is the SP's plain old HTTP response
back to the ECP for the original resource request - in our SP I
think that will generally really be a 3xx redirect to that
resource (e.g. /protected/file.txt).</p>
<p>So we don't know if all of that flow is actually happening for
the OP - we'd need logging etc from any or all of the 3 actors -
but what the OP said was happening is consistent with the expected
successful final response from the SP.</p>
<p>The only thing inconsistent with all of that is the statement
that the ecp.sh is complaining (at some point, unclear where)
about receiving HTML rather than XML. I think the most likely
explanations are:</p>
<p>1) the flow is happening correctly, the SP is successfully
responding correctly and this ecp.sh script is just broken.</p>
<p>2) the SP is misconfigured, the /protected/file.txt is actually
not protected by the SP, and so for the initial ECP request the
web server is just returning a plain HTTP response with the
content. The ecp.sh is correctly complaining that it's not the
expected SAML AuthnRequest conveyed via the PAOS binding.</p>
<p>For those cases the OP needs to figure out which of those it is
(or something else, if I've overlooked some case).<br>
</p>
</body>
</html>