AA Testing - Laptörténet

Bajnokk(AT)niif.hu: /* Source */ Add argument for AA cert, remove redundancy

2017-09-15T19:36:55Z

‎Source: Add argument for AA cert, remove redundancy

Bajnokk(AT)niif.hu: validation

2017-09-15T18:54:36Z

validation

Bajnokk(AT)niif.hu: getopt version of the script

2017-09-15T18:47:38Z

getopt version of the script

Bajnokk(AT)niif.hu: Bajnokk(AT)niif.hu átnevezte a(z) HEXAATest lapot a következő névre: AA Testing

2017-06-09T01:42:32Z

Bajnokk(AT)niif.hu átnevezte a(z) HEXAATest lapot a következő névre: AA Testing

Bajnokk(AT)niif.hu: creation

2017-06-09T01:23:44Z

creation

Új lap

The following shell script uses ''curl'' to query a SAML2 Attribute Authority.

You need a valid principal (eduPersonPrincipalName) and the X.509 credentials of an existing Service Provider to use this script.

----

<source lang="bash">
#!/bin/bash

# URL of the Attribute Authority
AA_URI="https://hexaa.eduid.hu:8443/simplesaml/module.php/aa/attributeserver.php"

# Testing principal (subject)
Principal=bajnokk@niif.hu

# HEXAA cert
AACert=/home/bajnokk/hexaa.eduid.hu-aa.crt

# EntityID and credentials of the SP on behalf of which
# the request is made
ReqSP="https://dev.aai.niif.hu/shibboleth"
ReqCert=/etc/shibboleth/dev.aai.niif.hu.shibboleth.crt
ReqKey=/etc/shibboleth/dev.aai.niif.hu.shibboleth.key

DATE=$(date --utc +%FT%TZ)
ReqID=$(hexdump -n 16 -e '4/4 "%08x" 1 "\n"' /dev/urandom)

read -r -d '' REQ_XML <<EOS
<S:Envelope xmlns:S="http://schemas.xmlsoap.org/soap/envelope/">
<S:Body>
<samlp:AttributeQuery xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="_$ReqID" IssueInstant="$DATE" Version="2.0">
<saml:Issuer>$ReqSP</saml:Issuer>
<saml:Subject>
<saml:NameID Format="urn:oid:1.3.6.1.4.1.5923.1.1.1.6">$Principal</saml:NameID>
</saml:Subject>
</samlp:AttributeQuery>
</S:Body>
</S:Envelope>
EOS

#debug echo "$REQ_XML"

echo "$REQ_XML" | \
curl --cacert $AACert --cert $ReqCert --key $ReqKey \
--header "Content-Type: text/xml;charset=UTF-8" --data @- $AA_URI
</source>
[[Category: HOWTO]]

@@ 6. sor: / 6. sor: @@
 <source lang="bash">
 #!/bin/bash
@@ 31. sor: / 32. sor: @@
 Options:
-   -a uri       Attribute Authority URI. Defaults to 'https://hexaa.eduid.hu:8443/simplesaml/module.php/aa/attributeserver.php'
+   -a uri       Attribute Authority URI. Defaults to '$AA_URI'
-   -p principal Testing principal (user name / subject). Defaults to 'bajnokk@niif.hu'.
+  -C certfile  Attribute Authority metadata certificate in PEM format. Defaults to '$AACert'.
-   -s entity    EntityID of the SP on behalf of which the request is made. Defaults to 'https://sp.hexaa.eduid.hu/test'
+   -p principal Testing principal (user name / subject). Defaults to '$Principal'.
-   -k keyfile   Key file in PEM format containing the key of the SP used for the request. Defaults to 'keys/test.sp.hexaa.eduid.hu-fed.key'
+   -s entity    EntityID of the SP on behalf of which the request is made. Defaults to '$ReqSP'
-   -c certfile  Cert file in PEM format containing the certificate of the SP used for the request. Defaults to 'keys/test.sp.hexaa.eduid.hu-fed.crt'
+   -k keyfile   Key file in PEM format containing the key of the SP used for the request. Defaults to '$ReqKey'
 EOS
          exit 3
@@ 45. sor: / 47. sor: @@
                  a)
                          AA_URI=$OPTARG
                          ;;
                  p)
@@ 89. sor: / 94. sor: @@
    curl --silent --show-error --cacert $AACert --cert $ReqCert --key $ReqKey \
         --header "Content-Type: text/xml;charset=UTF-8" --data @- $AA_URI
 </source>

@@ 3. sor: / 3. sor: @@
 You need a valid principal (eduPersonPrincipalName) and the X.509 credentials of an existing Service Provider to use this script.
-----
+== Source ==
 <source lang="bash">
@@ 91. sor: / 91. sor: @@
 </source>
 [[Category: HOWTO]]

@@ 7. sor: / 7. sor: @@
 <source lang="bash">
 #!/bin/bash
 # URL of the Attribute Authority
@@ 12. sor: / 14. sor: @@
 # Testing principal (subject)
-Principal=bajnokk@niif.hu
+Principal="bajnokk@niif.hu"
 # HEXAA cert
-AACert=/home/bajnokk/hexaa.eduid.hu-aa.crt
+AACert="$basedir/keys/hexaa.eduid.hu-aa.crt"
 # EntityID and credentials of the SP on behalf of which
 # the request is made
-ReqSP="https://dev.aai.niif.hu/shibboleth"
+ReqSP="https://sp.hexaa.eduid.hu/test"
-ReqCert=/etc/shibboleth/dev.aai.niif.hu.shibboleth.crt
+ReqCert="$basedir/keys/test.sp.hexaa.eduid.hu-fed.crt"
-ReqKey=/etc/shibboleth/dev.aai.niif.hu.shibboleth.key
+ReqKey="$basedir/keys/test.sp.hexaa.eduid.hu-fed.key"
 DATE=$(date --utc +%FT%TZ)
@@ 44. sor: / 87. sor: @@
 echo "$REQ_XML" | \
-   curl --cacert $AACert --cert $ReqCert --key $ReqKey \
+   curl --silent --show-error --cacert $AACert --cert $ReqCert --key $ReqKey \
         --header "Content-Type: text/xml;charset=UTF-8" --data @- $AA_URI
 </source>
 [[Category: HOWTO]]

← Régebbi változat	A lap 2017. június 9., 01:42-kori változata
(Nincs különbség)