topic Re: Verifying external SSO via telnet in Alfresco Archive

Verifying external SSO via telnet

award — Fri, 15 Nov 2013 22:31:27 GMT

If I understand the HTTP protocol correctly, it should be possible to validate an external SSO configuration by manually constructing an HTTP request and submitting it over telnet with the appropriate headers. For example, if share-config-custom.xml has the userHeader value set to "userId" and the s

Re: Verifying external SSO via telnet

award — Mon, 18 Nov 2013 19:32:46 GMT

Update:

To validate the process itself, I used the same technique on a server with a fresh install, without any special SSO configuration.

After establishing a valid session and logging in from my browser, I used a raw telnet session to load the user profile page. Here is the minimal HTTP request I was able to generate that would successfully return the content:


GET /share/page/user/admin/profile HTTP/1.1
Host: [redacted]:8080
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.101 Safari/537.36
Cookie: JSESSIONID=C73495264D12B577DB295EA150A22C24; alfLogin=[redacted]; alfUsername3=admin
‍‍‍‍‍‍

So, to restate my question…given that the above request works with a baseline configuration, can we create a similar request that could be used to validate an SSO configuration?

Re: Verifying external SSO via telnet

mrogers — Mon, 18 Nov 2013 22:05:23 GMT

Yes in principle your first example is fine for demonstrating external authentication via http. You just need to configure external authentication to use the userId property.