Which SP should I use about check-shib3idp-login HOT 7 CLOSED

The test uses the Unsollicited login functionality of Shib Idp3, i.e. login in on the Idp for a configured SP without going first to the SP in question. It does not matter what SP you use, as long as it's properly configured on de IdP. You don't need an special SP, we use one of our production websites.

The important part is that the login works. Then we check that the IdP sends a SAMLResponse:

Can you check in the IdP verbose logs (eg process) if you see name="SAMLResponse"?

from check-shib3idp-login.

Is it possible that the response is sent directly to the SP instead of being send back to the requester?

from check-shib3idp-login.

According to the documentation it looks like you're using SAML1 instead of SAML2. Could this be it?

"[SAML1] Formally speaking, this is not IdP-initiated SSO; it's a proprietary request to the IdP that results in a response to the SP. If you refer back to the initial discussion above, you can see that that's actually the definition of IdP-initiated SSO."

https://wiki.shibboleth.net/confluence/display/IDP30/UnsolicitedSSOConfiguration

from check-shib3idp-login.

I am using the SAML2 URL "/idp/profile/SAML2/Unsolicited/SSO" as it was given in the example. And I am currently testing it against the public SP from DFN (testsp3.aai.dfn.de).
Currently I'm running shibboleth 3.3.2.

from check-shib3idp-login.

Argh, ok, I found it. The test-user had to confirm the transmitted attributes first. After manually logging in and confirming the transmitted data permanently it works with the check as expected.

from check-shib3idp-login.

Ah, good catch!

This means we need a better error messaging for this case, that will be more common with the EU data privacy laws.

An option would be to attach the response in the error message here:
https://github.com/KULeuven-CCIS/check-shib3idp-login/blob/master/connection.go#L75

I'll add it to the TODO.

Thx,

C.

from check-shib3idp-login.

Added the response body in the message for a failed login. This will help identifying the problem you had a lot faster.

https://github.com/KULeuven-CCIS/check-shib3idp-login/releases/tag/v0.2.1

from check-shib3idp-login.