Shibboleth rejecting correct credentials

smellslikekeenspirit commented 5 years ago

My credentials are accurate but it's not logging in. I couldn't find what was wrong with the code, possible reasons why this might be happening?

volfco commented 5 years ago

2FA? Are you getting any errors?

smellslikekeenspirit commented 5 years ago

I'm getting a 200 status code. Does it have to do with the switch to MFA?

volfco commented 5 years ago

Probably. I can add in Selenium to fix that issue

a-allard commented 5 years ago

Hi I'm having a similar issue.

I traced it down to this section:

dta = {
                # TODO Make this dynamic and read the data from the response one I figure out how to decode the stuff. .decode() does not work
                "RelayState": "https://mycourses.rit.edu/d2l/shibbolethSSO/login.d2l",
                "SAMLResponse": re.search('(<input type="hidden" name="SAMLResponse" value=").*("/>)', rs.text).group(
                    0).replace('<input type="hidden" name="SAMLResponse" value="', '').replace('"/>', '')
            }

The re.search section is failing to find any of the strings. For debug the html stored in re.text is:

<!DOCTYPE html>
<html>
  <head>
    <meta charset="utf-8" />
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <meta name="theme-color" content="#F36E21">
    <link rel="shortcut icon" href="/favicon.ico" type="image/x-icon" />
<title>RIT Login</title>

<link rel='stylesheet' href='/css/combined.css'>
<script src="/js/jquery.min.js"></script>
<script src="/js/bootstrap.min.js"></script>

    <!-- HTML5 Shim and Respond.js IE8 support of HTML5 elements and media queries -->
    <!-- WARNING: Respond.js doesn't work if you view the page via file:// -->
    <!--[if lt IE 9]>
      <script src="/js/html5shiv.js"></script>
      <script src="/js/respond.min.js"></script>
    <![endif]-->

    <style id="antiClickjack">body{display:none !important;}</style>
    <script type="text/javascript">
       if (self === top) {
           var antiClickjack = document.getElementById("antiClickjack");
           antiClickjack.parentNode.removeChild(antiClickjack);
       } else {
           top.location = self.location;
       }

    </script>
    <style>
      #duo_iframe {
        width: 100%;
        min-width: 304px;
        max-width: 620px;
        height: 330px;
      }
    </style>
</head>

<style>
.container {
    max-width: 800px;
}
</style>

<body>
    <div id="metanav">
        <ul>
            <li id="metarithome"><a href="http://www.rit.edu/" title="RIT Home"><img src="/images/idbar-white.png" style="position: relative;top: 5px;"></a></li>
            <li id="metaritsearch">
                <div id="metaritsearchdiv">
                    <form id="metasearchform" method="get" action="https://www.rit.edu/search/">
                        <div>
                            <input id="metaritsearchbox" class="faded" name="q" type="text" value="Search RIT" maxlength="250" alt="Search box" onfocus="focusSearch(this)" onblur="blurSearch(this)" />
                            <button title="Submit Search">Search</button>
                        </div>
                    </form>
                </div>
            </li>
            <li id="metaritdirectories"><a href="http://www.rit.edu/directories/">Directories</a></li>
        </ul>
        <script type="text/javascript">
        function focusSearch(formfield){ if (formfield.defaultValue==formfield.value) formfield.value = ""; formfield.className = "focused"; }
        function blurSearch(formfield){ if (formfield.value==""){ formfield.value = formfield.defaultValue; formfield.className = "faded";} }
        </script>
    </div>

<div class='container'>

     <div class='well' align="center">

        <h2>RIT Login</h2>
        <p></p>

                          <p>
            Login to rit.brightspace.com
          </p>

        <div id="sessionexpired" class="alert alert-danger" style="display:none">Login Session Expired</div>

        <div id="userInput">

            <h3></h3>

            <noscript>The Duo service requires JavaScript.</noscript>          
            <script src="/idp/js/Duo-Web-v2.min.js"></script>
            <iframe id="duo_iframe"
                data-host="api-3d4a13e1.duosecurity.com"
                data-sig-request="TX|YWE5NzIwfERJRDZMU0pDUVowSlNHTEkzN0c5fDE1NjY5MjIyNzI=|8b5ded20a8bde6aa33a68ae6bf8ba23d268d2f7f:APP|YWE5NzIwfERJRDZMU0pDUVowSlNHTEkzN0c5fDE1NjY5MjU1NzI=|030708061bf3436b75ad06fc7a402a33640667c8"
                data-post-action="/idp/profile/SAML2/Redirect/SSO?execution=e1s2"
                frameborder="0"
            >
            </iframe>
            <form id="duo_form" method="post">
                <input type="hidden" name="_eventId" value="proceed" />

            </form>

        </div>

        <br>
        <p></p>
        <p>Don't have a phone? Want to make sure you're set if your phone fails? Get some <a href="https://www.rit.edu/its/mfa/enroll/offline-codes" target="_blank">Offline Codes</a>.</p>
        <p>Need assistance? Please contact the ITS Service Desk at<p /><a href="tel:15854754357">585-475-HELP [4357]</a> or <a href="mailto:servicedesk@rit.edu">servicedesk@rit.edu</a>.</p>

        <br>

     </div>

</div>

</body>
</html>

I tried to figure out what is being posted to where in chrome but was not able to deduce what was going on.

Thanks.

volfco commented 5 years ago

I'll take a swing at it this weekend

a-allard commented 5 years ago

@volfco Any update?

volfco / MyCoursesDownloader

Shibboleth rejecting correct credentials #16