Source:
public void testRedirectFlow() throws Exception { assertThat(getUserName(), not("admin")); ResponseHelper searchHelper = getSearchResponse(false, null); Response idpResponse = given() .auth() .preemptive() .basic("admin", "admin") .param("AuthMethod", "up") .params(searchHelper.params) .expect() .statusCode(200) .when() .get(searchHelper.redirectUrl); ResponseHelper idpHelper = new ResponseHelper(idpResponse); assertThat(idpHelper.parseBody(), is(Binding.POST)); String decodedSamlResponse = RestSecurity.base64Decode(idpHelper.postSamlResponse); validateSaml(decodedSamlResponse, SamlSchema.PROTOCOL); assertThat( decodedSamlResponse, allOf( containsString("urn:oasis:names:tc:SAML:2.0:status:Success"), containsString("ds:SignatureValue"), containsString("saml2:Assertion"), containsString("ds:Signature"))); assertThat( idpHelper.postRelayState.length(), is(both(greaterThanOrEqualTo(0)).and(lessThanOrEqualTo(80)))); String body = String.format( "SAMLResponse=%s&RelayState=%s", URLEncoder.encode(idpHelper.postSamlResponse, "UTF-8"), URLEncoder.encode(idpHelper.postRelayState, "UTF-8")); Response acsResponse = given() .body(body) .contentType("application/x-www-form-urlencoded") .redirects() .follow(false) .expect() .statusCode(anyOf(is(307), is(303))) .when() .post(searchHelper.params.get("ACSURL")); ResponseHelper acsHelper = new ResponseHelper(acsResponse); acsHelper.parseHeader(); given() .cookies(acsResponse.getCookies()) .expect() .statusCode(200) .when() .get(acsHelper.redirectUrl) .then() .log() .ifValidationFails(); assertThat(getUserName(acsResponse.getCookies()), is("admin")); }

Target:
public void testRedirectFlow() throws Exception { assertThat(getUserName(), not("admin")); ResponseHelper searchHelper = getSearchResponse(false, null); Response idpResponse = given() .auth() .preemptive() .basic("admin", "admin") .param("AuthMethod", "up") .params(searchHelper.params) .expect() .statusCode(200) .when() .get(searchHelper.redirectUrl); ResponseHelper idpHelper = new ResponseHelper(idpResponse); assertThat(idpHelper.parseBody(), is(Binding.POST)); String decodedSamlResponse = RestSecurity.base64Decode(idpHelper.postSamlResponse); validateSaml(decodedSamlResponse, SamlSchema.PROTOCOL); assertThat( decodedSamlResponse, allOf( containsString("urn:oasis:names:tc:SAML:2.0:status:Success"), containsString("ds:SignatureValue"), containsString("saml2:Assertion"), containsString("ds:Signature"))); assertThat( idpHelper.postRelayState.length(), is(both(greaterThanOrEqualTo(0)).and(lessThanOrEqualTo(80)))); String body = String.format( "SAMLResponse=%s&RelayState=%s", URLEncoder.encode(idpHelper.postSamlResponse, StandardCharsets.UTF_8.name()), URLEncoder.encode(idpHelper.postRelayState, StandardCharsets.UTF_8.name())); Response acsResponse = given() .body(body) .contentType("application/x-www-form-urlencoded") .redirects() .follow(false) .expect() .statusCode(anyOf(is(307), is(303))) .when() .post(searchHelper.params.get("ACSURL")); ResponseHelper acsHelper = new ResponseHelper(acsResponse); acsHelper.parseHeader(); given() .cookies(acsResponse.getCookies()) .expect() .statusCode(200) .when() .get(acsHelper.redirectUrl) .then() .log() .ifValidationFails(); assertThat(getUserName(acsResponse.getCookies()), is("admin")); }