title: Authenticate against WSO2 Identity Server with no browser and get SAML2 assertion message
body: <p>I am trying to setup a service provider that uses WSO2 IS for authentication via SAML2. Now, wehave a use-case in which the user is a machine (i.e. an external program) that needs to access the service provider. Since the user is a machine, there is no browser and cannot use the WSO2 login form to complete the authentication steps, though it has been given a username and password since it is still a user.</p>
  
  <p><strong>My question is how can this non-GUI user participate in the SAML2 workflow (specifically pass credentials to WSO2 to obtain a SAMLV2 Assertion message) and access the service provider?</strong> </p>
  
  <p>I tried to do the following as a simulation but I failed</p>
  
  <pre><code>1) curl -v -k http://localhost:8000/service_provider/login
  2) Extracting the SAML message from the response:
      curl --user username:password -v  -k https://localhost:9443/samlsso?SAMLRequest=&lt;ENCODED_REQUEST&gt;
  </code></pre>
  
  <p>Basically, I was expecting to get a redirect response from WSO2 back to the service provider with SAML assertion message, but instead I got the following:
          <a href="https://localhost:9443/authenticationendpoint/login.do;jsessionid=7QON18982323HWIH?commonAuthCallerPath=%2Fsamlsso&amp;forceAuth=false&amp;passiveAuth=false&amp;tenantDomain=carbon.super&amp;sessionDataKey=122JhQ-JQOJ-H8123&amp;relyingParty=test-saml2&amp;type=samlsso&amp;sp=test&amp;isSaaSApp=false&amp;authenticators=BasicAuthenticator:LOCAL" rel="nofollow">https://localhost:9443/authenticationendpoint/login.do;jsessionid=7QON18982323HWIH?commonAuthCallerPath=%2Fsamlsso&amp;forceAuth=false&amp;passiveAuth=false&amp;tenantDomain=carbon.super&amp;sessionDataKey=122JhQ-JQOJ-H8123&amp;relyingParty=test-saml2&amp;type=samlsso&amp;sp=test&amp;isSaaSApp=false&amp;authenticators=BasicAuthenticator:LOCAL</a>, which is the same url that is used when a human user authenticates using a browser. </p>
  
  <p>I also tried using HTTP-POST Binding with "sectoken" form param as suggested in this article: <a href="http://xacmlinfo.org/2015/02/12/sso-without-identity-provider-login-page/" rel="nofollow">http://xacmlinfo.org/2015/02/12/sso-without-identity-provider-login-page/</a> . But it didn't work either.</p>
  
  <p>I also tried making SOAP requests to WSO2's AuthenticationAdminHttpsSoap12Endpoint service, specifically the "login" method. I used the JSESSIONID I got from the SOAP response to the above steps but the effect was the same. This is not a surprise to me since WSO2 does not use JSESSIONID to check if you are authenticated already (at least not for trying to grab SAML responses). </p>