If single sign-on (SSO) has been enabled, you must issue a series of API requests to obtain an authentication token from AD FS that is valid for the Grid Management API or the Tenant Management API.
If you have a URL-encoding issue, you might see the error: Unsupported SAML version.
export SAMLUSER='my-sso-username' export SAMLPASSWORD='my-password' export SAMLDOMAIN='my-domain' export TENANTACCOUNTID=’12345’ export STORAGEGRID_ADDRESS='storagegrid.example.com' export AD_FS_ADDRESS='adfs.example.com'
curl -X POST "https://$STORAGEGRID_ADDRESS/api/v3/authorize-saml" \ -H "accept: application/json" -H "Content-Type: application/json" \ --data "{\"accountId\": \"$TENANTACCOUNTID\"}" | python -m json.tool
{ "apiVersion": "3.0", "data": "https://adfs.example.com/adfs/ls/?SAMLRequest=fZHLbsIwEEV%2FJTuv7...sSl%2BfQ33cvfwA%3D&RelayState=12345", "responseTime": "2018-11-06T16:30:23.355Z", "status": "success" }
export SAMLREQUEST='fZHLbsIwEEV%2FJTuv7...sSl%2BfQ33cvfwA%3D'
curl "https://$AD_FS_ADDRESS/adfs/ls/?SAMLRequest=$SAMLREQUEST&RelayState=$TENANTACCOUNTID" | grep 'form method="post" id="loginForm"'
<form method="post" id="loginForm" autocomplete="off" novalidate="novalidate" onKeyPress="if (event && event.keyCode == 13) Login.submitLoginRequest();" action="/adfs/ls/? SAMLRequest=fZHRToMwFIZfhb...UJikvo77sXPw%3D%3D&RelayState=12345&client-request-id=00000000-0000-0000-ee02-0080000000de" >
export SAMLREQUESTID='00000000-0000-0000-ee02-0080000000de'
curl -X POST "https://$AD_FS_ADDRESS/adfs/ls/?SAMLRequest=$SAMLREQUEST&RelayState=$TENANTACCOUNTID&client-request-id=$SAMLREQUESTID" \ --data "UserName=$SAMLUSER@$SAMLDOMAIN&Password=$SAMLPASSWORD&AuthMethod=FormsAuthentication" --include
AD FS returns a 302 redirect, with additional information in the headers.
HTTP/1.1 302 Found Content-Length: 0 Content-Type: text/html; charset=utf-8 Location: https://adfs.example.com/adfs/ls/?SAMLRequest=fZHRToMwFIZfhb...UJikvo77sXPw%3D%3D&RelayState=12345&client-request-id=00000000-0000-0000-ee02-0080000000de Set-Cookie: MSISAuth=AAEAADAvsHpXk6ApV...pmP0aEiNtJvWY=; path=/adfs; HttpOnly; Secure Date: Tue, 06 Nov 2018 16:55:05 GMT
export MSISAuth='AAEAADAvsHpXk6ApV...pmP0aEiNtJvWY='
curl "https://$AD_FS_ADDRESS/adfs/ls/?SAMLRequest=$SAMLREQUEST&RelayState=$TENANTACCOUNTID&client-request-id=$SAMLREQUESTID" \ --cookie "MSISAuth=$MSISAuth" --include
HTTP/1.1 200 OK Cache-Control: no-cache,no-store Pragma: no-cache Content-Length: 5665 Content-Type: text/html; charset=utf-8 Expires: -1 Server: Microsoft-HTTPAPI/2.0 P3P: ADFS doesn't have P3P policy, please contact your site's admin for more details Set-Cookie: SamlSession=a3dpbnRlcnMtUHJpbWFyeS1BZG1pbi0xNzgmRmFsc2Umcng4NnJDZmFKVXFxVWx3bkl1MnFuUSUzZCUzZCYmJiYmXzE3MjAyZTA5LThmMDgtNDRkZC04Yzg5LTQ3NDUxYzA3ZjkzYw==; path=/adfs; HttpOnly; Secure Set-Cookie: MSISAuthenticated=MTEvNy8yMDE4IDQ6MzI6NTkgUE0=; path=/adfs; HttpOnly; Secure Set-Cookie: MSISLoopDetectionCookie=MjAxOC0xMS0wNzoxNjozMjo1OVpcMQ==; path=/adfs; HttpOnly; Secure Date: Wed, 07 Nov 2018 16:32:59 GMT <form method="POST" name="hiddenform" action="https://storagegrid.example.com:443/api/saml-response"> <input type="hidden" name="SAMLResponse" value="PHNhbWxwOlJlc3BvbnN...1scDpSZXNwb25zZT4=" /><input type="hidden" name="RelayState" value="12345" />
export SAMLResponse='PHNhbWxwOlJlc3BvbnN...1scDpSZXNwb25zZT4='
curl -X POST "https://$STORAGEGRID_ADDRESS:443/api/saml-response" \ -H "accept: application/json" \ --data-urlencode "SAMLResponse=$SAMLResponse" \ --data-urlencode "RelayState=$TENANTACCOUNTID" \ | python -m json.tool
{ "apiVersion": "3.0", "data": "56eb07bf-21f6-40b7-af0b-5c6cacfb25e7", "responseTime": "2018-11-07T21:32:53.486Z", "status": "success" }
export MYTOKEN="56eb07bf-21f6-40b7-af0b-5c6cacfb25e7"