login - Logging into SAML/Shibboleth authenticated server using python -

i'm trying login university's server via python, i'm entirely unsure of how go generating appropriate http posts, creating keys , certificates, , other parts of process may unfamiliar required comply saml spec. can login browser fine, i'd able login , access other contents within server using python.

for reference, here site

i've tried logging in using mechanize (selecting form, populating fields, clicking submit button control via mechanize.broswer.submit(), etc.) no avail; login site gets spat each time.

at point, i'm open implementing solution in whichever language suitable task. basically, want programatically login saml authenticated server.

basically have understand workflow behind salm authentication process. unfortunately, there no pdf out there seems provide in finding out kind of things browser when accessing saml protected website.

maybe should take this: http://www.docstoc.com/docs/33849977/workflow-to-use-shibboleth-authentication-to-sign , this: http://en.wikipedia.org/wiki/security_assertion_markup_language. in particular, focus attention scheme:

what did when trying understand saml way of working, since documentation so poor, writing down (yes! writing - on paper) steps browser doing first last. used opera, setting in order not allow automatic redirects (300, 301, 302 response code, , on), , not enabling javascript. wrote down cookies server sending me, doing what, , reason.

maybe way effort, in way able write library, in java, suited job, , incredibily fast , efficient too. maybe someday release public...

what should understand that, in saml login, there 2 actors playing: idp (identity provider), , sp (service provider).

a. first step: user agent request resource sp

i'm quite sure reached link reference in question page clicking "access protected website". if make more attention, you'll notice link followed not 1 in authentication form displayed. that's because clicking of link idp sp step saml. first step, actally. allows idp define you, , why trying access resource. so, you'll need making request link followed in order reach web form, , getting cookies it'll set. won't see samlrequest string, encoded 302 redirect find behind link, sent idp making connection.

i think it's reason why can't mechanize whole process. connected form, no identity identification done!

b. second step: filling form, , submitting it

this 1 easy. please careful! cookies now set not same of cookies above. you're connecting utterly different website. that's reason why saml used: different website, same credentials. may want store these authentication cookies, provided successful login, different variable. idp going send response (after samlrequest): samlresponse. have detect getting source code of webpage login ends. in fact, page big form containing response, code in js automatically subits it, when page loads. have source code of page, parse getting rid of html unuseful stuff, , getting samlresponse (encrypted).

c. third step: sending response sp

now you're ready end procedure. have send (via post, since you're emulating form) samlresponse got in previous step, sp. in way, provide cookies needed access protected stuff want access.

aaaaand, you're done!

again, think precious thing you'll have using opera , analyzing redirects saml does. then, replicate them in code. it's not difficult, keep in mind idp utterly different sp.