Forum Discussion
Rabbit23_116296
Nimbostratus
Jun 23, 2014Thanks no I couldn't get the replace to work. I started by changing the assertion consumer URL for the HTTP post to be a local test virtual server with the intention of manipulating the payload in transit. This will probably not work seeing as its an encoded XML based assertion, adding more complexity..
Would it be possible with stream to capture this 302 post to the assertion consumer service URL?
i.e. my browser does a post with body to https://wd3.myworkday.com//login-saml.flex:
SAMLResponse=PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48c2FtbDJwOlJlc3BvbnNlIElEPSJfMWIxMDdmOTc2YWI3MTc0NGM3MDBjYmRlZDRlODM1OGE4YTJkZDEiIElzc3VlSW5zd
Decoded will be:
So it all seems possible, I could if necessary post to a local layered virtual server. Capture and deflate the decoded SAMLResponse, replace the Destination value, inflate the SAML response and then post it to the correct service provider.
It all seems pretty painful!