Commit 818df67

mo <mo@mokhan.ca>
2018-10-29 17:37:55
load key pairs from env variables.
main
1 parent 05442ae
Changed files (21)
config
initializers
saml_kit.rb
routes.rb
doc
_includes
get-well-known-oauth-authorization-server.html
oauth-dynamic-client-registration.html
oauth-token-introspection.html
oauth-tokens-authorization-code.html
oauth-tokens-client-credentials.html
oauth-tokens-password.html
oauth-tokens-pkce.html
oauth-tokens-refresh-token.html
oauth-tokens-saml-assertion.html
scim-resource-type-group.html
scim-resource-type-user.html
scim-resource-types.html
scim-schemas-groups.html
scim-schemas-users.html
scim-schemas.html
scim-service-provider-config.html
spec
documentation.rb
.env
.gitignore
config/initializers/saml_kit.rb
@@ -1,18 +1,26 @@
 # frozen_string_literal: true
 
-class OnDemandRegistry < SimpleDelegator
+class OnDemandRegistry < Saml::Kit::DefaultRegistry
   def metadata_for(entity_id)
-    found = __getobj__.metadata_for(entity_id)
+    found = super(entity_id)
     return found if found
 
-    __getobj__.register_url(entity_id, verify_ssl: Rails.env.production?)
-    __getobj__.metadata_for(entity_id)
+    register_url(entity_id, verify_ssl: Rails.env.production?)
+    super(entity_id)
   end
 end
 
 Saml::Kit.configure do |x|
   x.entity_id = ENV['ISSUER']
-  x.registry = OnDemandRegistry.new(x.registry)
+  x.registry = OnDemandRegistry.new
   x.logger = Rails.logger
-  5.times { x.generate_key_pair_for(use: :signing) }
+  if ENV['SAML_PRIVATE_KEY'].present? && ENV['SAML_X509_CERTIFICATE'].present?
+    x.add_key_pair(
+      ENV['SAML_X509_CERTIFICATE'],
+      ENV['SAML_PRIVATE_KEY'],
+      use: :signing
+    )
+  else
+    5.times { x.generate_key_pair_for(use: :signing) }
+  end
 end
config/routes.rb
@@ -2,7 +2,7 @@ Rails.application.routes.draw do
   # For details on the DSL available within this file, see http://guides.rubyonrails.org/routing.html
   post "/session/logout" => "sessions#destroy", as: :logout
   post "/session/new" => "sessions#new"
-  post '/oauth/token', to: 'tokens#create'
+  post '/oauth/token', to: 'oauth/tokens#create'
   resource :mfa, only: [:new, :create]
   resource :metadata, only: [:show]
   resource :session, only: [:new, :create, :destroy]
doc/_includes/get-well-known-oauth-authorization-server.html
@@ -29,7 +29,7 @@ Response:
 Content-Type: application/json; charset=utf-8
 Etag: W/"7f1eee6ebfc3008c58d630548ed1707c"
 Cache-Control: max-age=0, private, must-revalidate
-X-Request-Id: ecce7aae-c9da-4fd4-bd2f-758658bfc3a6
+X-Request-Id: 54c2fecc-7fc7-47b9-880e-a2953ad1e4c3
 Transfer-Encoding: chunked
 ```
 ```json
doc/_includes/oauth-dynamic-client-registration.html
@@ -6,7 +6,7 @@ Example curl request:
 ```bash
 $ curl http://localhost:5000/oauth/clients \
   -X POST \
-  -d '{"redirect_uris":["https://turnerking.name","https://stoltenberg.co.uk"],"client_name":"Kenna Raynor","token_endpoint_auth_method":"client_secret_basic","logo_uri":"https://kub.ca","jwks_uri":"https://kleinbosco.info"}' \
+  -d '{"redirect_uris":["https://ernser.com","https://schultz.biz"],"client_name":"Jeffrey Jewess","token_endpoint_auth_method":"client_secret_basic","logo_uri":"https://hagenesjohnson.com","jwks_uri":"https://balistreri.biz"}' \
   -H "Accept: application/json" \
   -H "Content-Type: application/json" \
   -H "User-Agent: net/hippie 0.1.9" \
@@ -22,13 +22,13 @@ Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3
 ```json
 {
   "redirect_uris": [
-    "https://turnerking.name",
-    "https://stoltenberg.co.uk"
+    "https://ernser.com",
+    "https://schultz.biz"
   ],
-  "client_name": "Kenna Raynor",
+  "client_name": "Jeffrey Jewess",
   "token_endpoint_auth_method": "client_secret_basic",
-  "logo_uri": "https://kub.ca",
-  "jwks_uri": "https://kleinbosco.info"
+  "logo_uri": "https://hagenesjohnson.com",
+  "jwks_uri": "https://balistreri.biz"
 }
 ```
 Response:
@@ -38,18 +38,18 @@ Response:
 Cache-Control: no-cache, no-store
 Pragma: no-cache
 Content-Type: application/json; charset=utf-8
-X-Request-Id: ee26549e-25d4-4d55-ad8d-d0daf2580edc
+X-Request-Id: 7962b362-cf07-4b8e-944c-5a8e699f4f5d
 Transfer-Encoding: chunked
 ```
 ```json
 {
-  "client_id": "0f7d01f2-6581-4f99-a9d6-ffc23322005e",
-  "client_secret": "RZEsEaat1mvBFiAJXno8dnph",
-  "client_id_issued_at": 1540776653,
+  "client_id": "b982b9b8-a3f8-49c7-ac22-5a1390f473f6",
+  "client_secret": "HNkbB3iTvgVmaiZeCchsaRJC",
+  "client_id_issued_at": 1540834467,
   "client_secret_expires_at": 0,
   "redirect_uris": [
-    "https://turnerking.name",
-    "https://stoltenberg.co.uk"
+    "https://ernser.com",
+    "https://schultz.biz"
   ],
   "grant_types": [
     "authorization_code",
@@ -58,10 +58,10 @@ Transfer-Encoding: chunked
     "password",
     "urn:ietf:params:oauth:grant-type:saml2-bearer"
   ],
-  "client_name": "Kenna Raynor",
+  "client_name": "Jeffrey Jewess",
   "token_endpoint_auth_method": "client_secret_basic",
-  "logo_uri": "https://kub.ca",
-  "jwks_uri": "https://kleinbosco.info"
+  "logo_uri": "https://hagenesjohnson.com",
+  "jwks_uri": "https://balistreri.biz"
 }
 ```
doc/_includes/oauth-token-introspection.html
@@ -6,11 +6,11 @@ Example curl request:
 ```bash
 $ curl http://localhost:5000/oauth/tokens/introspect \
   -X POST \
-  -d '{"token":"eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA3ODAyNTMsImlhdCI6MTU0MDc3NjY1NCwiaXNzIjoiaHR0cDovL3Byb29mLnRlc3Q6NTAwMC9tZXRhZGF0YSIsIm5iZiI6MTU0MDc3NjY1NCwiYXVkIjoiMTNhNDBhYjUtZDY4NC00NjkyLWJiYTItYmRiOGUwZmUwODBjIiwianRpIjoiN2ExNWM1MmYtZjQ4OC00ZjA2LTk1NmQtZWNiYWYyZTNjMmJmIiwic3ViIjoiZDc5ZjhiYjgtMmNiZi00ZjU2LTgxNDgtYjU0M2U3ZGMxNTJmIiwidG9rZW5fdHlwZSI6ImFjY2VzcyJ9.RaAAFIr5nE78hszmA_taqApJr2c5LyE_DwIUU1Es7ojYAmPABaMY4zOiASD8i2_BnPJ6gVNTtnyen-qvgqWuglh0__dt3_5kb83JqVn_QTl6FEQg96FBD2kst3yZQyxspJlvnDwsvVlQVfeiJx6NblhzEzLESiQEhNbJ0YLz1Eq3mpPmhrNa0JaCIWhKEB7desYl-UHElDv8RhpfZsWG8sXP1e3KlBjolC1AzvbxUY_psFyhyc52VclwEJrjwZ6KUZt7E2TulQMbgs1bp-MifksCpkd_RJIgH4umhIQtWpd-cvsyUmDOsLQJ-liqQWGpX8idiIXXHNxiwMftAG4yJw"}' \
+  -d '{"token":"eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA4MzgwNjcsImlhdCI6MTU0MDgzNDQ2NywiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo1MDAwL21ldGFkYXRhIiwibmJmIjoxNTQwODM0NDY3LCJhdWQiOiJjMjgzNDUyMC04ZmJhLTRkZmUtOGQyYS05YzkzZTc5YzgyN2YiLCJqdGkiOiIyZDMwMzNlYS02NTcwLTRkMDItODM0ZS00NGUxY2I5MjEzZGMiLCJzdWIiOiI5NzFhMDBmNC0xY2MyLTRhZDAtOTYyMS0xY2YwYjZiMjBkNjciLCJ0b2tlbl90eXBlIjoiYWNjZXNzIn0.WDP5ZNxx2aCoPu6Z5vjoFpl4R3lmd7EyJjjkAf5pRgbMFvfLhXp-g8rNw6PUQGsZh3X0KsUKKdDZdWj7lj_ahST3VN3crFgrJdjzG05rGUp7MUb_IULt1lnnzP3f3bosbHazbyHailrX6_XXHlwxw8ajVZ7SnSzWxzNupOEiXP78bJGd2sVTbUnP2yQCrdHe4kMuGsGYTjlLJv8Va_lPk2bok9yH11oX7e1bUl2WYysaN0bMkNS6GJK48ZwI1d0X_2WWEP7WVTRynvJpzJc2PN-9Pq7T187bUy5KiBf2gBMMFnzNtoBmYY0cpcc2ybO5cpjq0nqQhGMpDBcb-vDcUQzOX_i_BbbSk0Eo0697fbO6ndyNoonTUV3GuVlxG6Y4Td2QIaT6G06kaJzKCcFRPnjUxUVdwphSNmU1CKBlK9wgbyw85V04_Yz02g1pQ6poXd2cIr7048826nn4ZrrW1382EFFZDj004beothQK9uURERv1o5qp5PDaSeAUSOUW5YyOAZ-gLISTeoeC41PUstFCWv4XV3-vPq6bohMGIoo3Fr2GIyfD1uQxlV4bQvt-2ONQ2S-UeZSnr1oZdJYhlNFIxnS-Unkp0oyjE2133PLuazIC9ywI_Hh3Prk1tdg3zEMA3ZgsUMDayrAc-z5LHkfjwsAFlWtEQE74HiDHcTI"}' \
   -H "Accept: application/json" \
   -H "Content-Type: application/json" \
   -H "User-Agent: net/hippie 0.1.9" \
-  -H "Authorization: Basic ZThkYmQwMjMtYjkzOC00ZDIwLWJlOGUtNDg5YTQ1M2E5MTgxOmQzM0NVNEJLZjdCNE5IeW1UNHRiZjZmUA==" \
+  -H "Authorization: Basic NmNmOGZiMzQtMTY1NS00OTdkLTkyODktZTczYzBkZjI2NTg3OmtKNndUam9DZnMzeFY1NW1iQ3gyVTFLcQ==" \
   -H "Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3"
 ```
 Request:
@@ -18,12 +18,12 @@ Request:
 Accept: application/json
 Content-Type: application/json
 User-Agent: net/hippie 0.1.9
-Authorization: Basic ZThkYmQwMjMtYjkzOC00ZDIwLWJlOGUtNDg5YTQ1M2E5MTgxOmQzM0NVNEJLZjdCNE5IeW1UNHRiZjZmUA==
+Authorization: Basic NmNmOGZiMzQtMTY1NS00OTdkLTkyODktZTczYzBkZjI2NTg3OmtKNndUam9DZnMzeFY1NW1iQ3gyVTFLcQ==
 Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3
 ```
 ```json
 {
-  "token": "eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA3ODAyNTMsImlhdCI6MTU0MDc3NjY1NCwiaXNzIjoiaHR0cDovL3Byb29mLnRlc3Q6NTAwMC9tZXRhZGF0YSIsIm5iZiI6MTU0MDc3NjY1NCwiYXVkIjoiMTNhNDBhYjUtZDY4NC00NjkyLWJiYTItYmRiOGUwZmUwODBjIiwianRpIjoiN2ExNWM1MmYtZjQ4OC00ZjA2LTk1NmQtZWNiYWYyZTNjMmJmIiwic3ViIjoiZDc5ZjhiYjgtMmNiZi00ZjU2LTgxNDgtYjU0M2U3ZGMxNTJmIiwidG9rZW5fdHlwZSI6ImFjY2VzcyJ9.RaAAFIr5nE78hszmA_taqApJr2c5LyE_DwIUU1Es7ojYAmPABaMY4zOiASD8i2_BnPJ6gVNTtnyen-qvgqWuglh0__dt3_5kb83JqVn_QTl6FEQg96FBD2kst3yZQyxspJlvnDwsvVlQVfeiJx6NblhzEzLESiQEhNbJ0YLz1Eq3mpPmhrNa0JaCIWhKEB7desYl-UHElDv8RhpfZsWG8sXP1e3KlBjolC1AzvbxUY_psFyhyc52VclwEJrjwZ6KUZt7E2TulQMbgs1bp-MifksCpkd_RJIgH4umhIQtWpd-cvsyUmDOsLQJ-liqQWGpX8idiIXXHNxiwMftAG4yJw"
+  "token": "eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA4MzgwNjcsImlhdCI6MTU0MDgzNDQ2NywiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo1MDAwL21ldGFkYXRhIiwibmJmIjoxNTQwODM0NDY3LCJhdWQiOiJjMjgzNDUyMC04ZmJhLTRkZmUtOGQyYS05YzkzZTc5YzgyN2YiLCJqdGkiOiIyZDMwMzNlYS02NTcwLTRkMDItODM0ZS00NGUxY2I5MjEzZGMiLCJzdWIiOiI5NzFhMDBmNC0xY2MyLTRhZDAtOTYyMS0xY2YwYjZiMjBkNjciLCJ0b2tlbl90eXBlIjoiYWNjZXNzIn0.WDP5ZNxx2aCoPu6Z5vjoFpl4R3lmd7EyJjjkAf5pRgbMFvfLhXp-g8rNw6PUQGsZh3X0KsUKKdDZdWj7lj_ahST3VN3crFgrJdjzG05rGUp7MUb_IULt1lnnzP3f3bosbHazbyHailrX6_XXHlwxw8ajVZ7SnSzWxzNupOEiXP78bJGd2sVTbUnP2yQCrdHe4kMuGsGYTjlLJv8Va_lPk2bok9yH11oX7e1bUl2WYysaN0bMkNS6GJK48ZwI1d0X_2WWEP7WVTRynvJpzJc2PN-9Pq7T187bUy5KiBf2gBMMFnzNtoBmYY0cpcc2ybO5cpjq0nqQhGMpDBcb-vDcUQzOX_i_BbbSk0Eo0697fbO6ndyNoonTUV3GuVlxG6Y4Td2QIaT6G06kaJzKCcFRPnjUxUVdwphSNmU1CKBlK9wgbyw85V04_Yz02g1pQ6poXd2cIr7048826nn4ZrrW1382EFFZDj004beothQK9uURERv1o5qp5PDaSeAUSOUW5YyOAZ-gLISTeoeC41PUstFCWv4XV3-vPq6bohMGIoo3Fr2GIyfD1uQxlV4bQvt-2ONQ2S-UeZSnr1oZdJYhlNFIxnS-Unkp0oyjE2133PLuazIC9ywI_Hh3Prk1tdg3zEMA3ZgsUMDayrAc-z5LHkfjwsAFlWtEQE74HiDHcTI"
 }
 ```
 Response:
@@ -31,14 +31,22 @@ Response:
 200 OK
 
 Content-Type: application/json; charset=utf-8
-Etag: W/"78b558bd2357fbe7ad52804fb3af1b86"
+Etag: W/"ba6487afc83740c5b347899866c45254"
 Cache-Control: max-age=0, private, must-revalidate
-X-Request-Id: 81493a57-9e3c-4daf-a21e-90c4580fa083
+X-Request-Id: 021bfbe4-6e06-46fb-ab98-d7737d2a5f43
 Transfer-Encoding: chunked
 ```
 ```json
 {
-  "active": false
+  "exp": 1540838067,
+  "iat": 1540834467,
+  "iss": "http://localhost:5000/metadata",
+  "nbf": 1540834467,
+  "aud": "c2834520-8fba-4dfe-8d2a-9c93e79c827f",
+  "jti": "2d3033ea-6570-4d02-834e-44e1cb9213dc",
+  "sub": "971a00f4-1cc2-4ad0-9621-1cf0b6b20d67",
+  "token_type": "access",
+  "active": true
 }
 ```
doc/_includes/oauth-tokens-authorization-code.html
@@ -6,11 +6,11 @@ Example curl request:
 ```bash
 $ curl http://localhost:5000/oauth/tokens \
   -X POST \
-  -d '{"grant_type":"authorization_code","code":"hV9ff5yEJD5H9EoMx5RGRYSN"}' \
+  -d '{"grant_type":"authorization_code","code":"KwuYwtE69C5dvhbpxwekp5ie"}' \
   -H "Accept: application/json" \
   -H "Content-Type: application/json" \
   -H "User-Agent: net/hippie 0.1.9" \
-  -H "Authorization: Basic YTY1YmM0ODktMGVhMS00NjkyLTk5ODItYzNkNGVmNWU4MDVmOjFRMU1ja2lXWmtIZjI0R0FWZEtIekw1Yw==" \
+  -H "Authorization: Basic MjA5OTA4N2EtMDdmZi00ZThkLTljOGEtYmZmNWNkNjdlMGRkOnZQZWduZnRWNzUxaHdmTW1ZaGs0RG9FbQ==" \
   -H "Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3"
 ```
 Request:
@@ -18,13 +18,13 @@ Request:
 Accept: application/json
 Content-Type: application/json
 User-Agent: net/hippie 0.1.9
-Authorization: Basic YTY1YmM0ODktMGVhMS00NjkyLTk5ODItYzNkNGVmNWU4MDVmOjFRMU1ja2lXWmtIZjI0R0FWZEtIekw1Yw==
+Authorization: Basic MjA5OTA4N2EtMDdmZi00ZThkLTljOGEtYmZmNWNkNjdlMGRkOnZQZWduZnRWNzUxaHdmTW1ZaGs0RG9FbQ==
 Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3
 ```
 ```json
 {
   "grant_type": "authorization_code",
-  "code": "hV9ff5yEJD5H9EoMx5RGRYSN"
+  "code": "KwuYwtE69C5dvhbpxwekp5ie"
 }
 ```
 Response:
@@ -34,16 +34,16 @@ Response:
 Cache-Control: private, no-store
 Pragma: no-cache
 Content-Type: application/json; charset=utf-8
-Etag: W/"e09082d6cdb21e59e3f084be07faed87"
-X-Request-Id: fec54ac3-b663-4565-be5c-619dc4224365
+Etag: W/"02c4124cd382f6fd8bcd453970193ea4"
+X-Request-Id: 03f7448c-5ae8-4f0c-8fa1-5298665c8a9b
 Transfer-Encoding: chunked
 ```
 ```json
 {
-  "access_token": "eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA3ODAyNTIsImlhdCI6MTU0MDc3NjY1MiwiaXNzIjoiaHR0cDovL3Byb29mLnRlc3QvbWV0YWRhdGEiLCJuYmYiOjE1NDA3NzY2NTIsImF1ZCI6ImE2NWJjNDg5LTBlYTEtNDY5Mi05OTgyLWMzZDRlZjVlODA1ZiIsImp0aSI6ImQwODUzYTQ1LTRiZjgtNDFkYS1iY2I4LTc2MGY2M2ViOTczNCIsInN1YiI6ImRmMjNhMWM0LTM1MmUtNDliYy04MjVjLTJmYTc3NTVlNWNiMCIsInRva2VuX3R5cGUiOiJhY2Nlc3MifQ.eDik1b7Td3AZMA-I_iATAB1U3Dtt2-DYMItP-D3BRxODQnlkCYjbSbj32A3jCNaybj-aby0xKINwgwFeeNQ55AA-6LT5nU6xbcygLA9269tJUE4DqLdQg40zqoEVuKWPrURvwHcbf_WufYAQKSax9SyJnqqYndAbdGCQlESrA8Qu0Vh-vjNQXYFKvPLoegQTejuUjzDjdc4UmQKWd3xYASQ3i3o3dKmSTV-9BxUmXrVgX1qRPRRRjLkAhTqlzCZ2pX194d-2zmQnH4U-J7yMnHp7ff34qBGenEArTgH73g0wfdzeTO5_DFEXdYaFgZboHyzhI7HaXXn5RwWP0uL4yA",
+  "access_token": "eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA4MzgwNjUsImlhdCI6MTU0MDgzNDQ2NSwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo1MDAwL21ldGFkYXRhIiwibmJmIjoxNTQwODM0NDY1LCJhdWQiOiIyMDk5MDg3YS0wN2ZmLTRlOGQtOWM4YS1iZmY1Y2Q2N2UwZGQiLCJqdGkiOiI4YzU2ZTUwNS03ZmY4LTRjMjUtYWUyNS1lMmJlNTE2MWJhODYiLCJzdWIiOiJlMDcxZGRhMy0wZjVhLTRiODktODkxMy1kNDdmM2UxNTE3MTAiLCJ0b2tlbl90eXBlIjoiYWNjZXNzIn0.WsdISeM6ZyAgyVveLAfiRluE1Z0HOjn6Qflo7QxdrlnRJo2zbAFCO8Wu-FHhMPir9jFJYWO689xMcxF3q93OWlqCWPtJsuZTczg_O4iQyBVKcuWFy41iPTozCREqe0ixPVfVYHJS7myLHFBrLJ5yifqeI0GPF5cKbZC1FyIGOx5ilurkBq2fZjVh0WLtzn2W9oRHCQA-iUV3tHoSF3-yT6VaHGAv-PYokstqWLDZjJDIz-qIEaGyWdVnkkTKLx0c-M65qHh57YnBi35JgY0flqqcNqFzZ4x4t5lMKSLHlVcZVvx1O7saN0bqxi_yM7HApT-CUKmoDVbd-jrObTu6XgmfOYthKtfHMQ_Av7VDUtSfb5ETBzTmRG0VeRj1osKy-SBLFyxTOiVoeYwykncQNDKEwAqGcBot3GQ8jsolcc3vvuhfskiF0dPVbqSyUJkYfMVhPGFD56S6xKb1Il9ljbREAoAhxEv4e7bZXJABbZXlFts4PtV1F5Ua7tvvI37ja5QCJWeM8U16ApCwmLw7RCIEQ9eMjS8us1e6zWaaJJ6Wdsuca8-UPNhiHHxYY0qQUMfGBYmiyYmDRskNhowc_HBUuu_LWo7ChWOmdflxDPQvYNPlnlSjbAnnJKF2AVF5z83C9uUAtJa96vo-IK4lkldriF7ah7p5pMQq5O3rQr0",
   "token_type": "Bearer",
   "expires_in": 3600,
-  "refresh_token": "eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA4NjMwNTIsImlhdCI6MTU0MDc3NjY1MiwiaXNzIjoiaHR0cDovL3Byb29mLnRlc3QvbWV0YWRhdGEiLCJuYmYiOjE1NDA3NzY2NTIsImF1ZCI6ImE2NWJjNDg5LTBlYTEtNDY5Mi05OTgyLWMzZDRlZjVlODA1ZiIsImp0aSI6IjNhMmRmZDhiLTdjOGUtNGY1NC05Mzk0LTY0MThkNWU5YjRhNSIsInN1YiI6ImRmMjNhMWM0LTM1MmUtNDliYy04MjVjLTJmYTc3NTVlNWNiMCIsInRva2VuX3R5cGUiOiJyZWZyZXNoIn0.On0-azTdyUTKh-Vx_-pXL4W6uaEg1oXCa6TO4cw1X30PWDIMWcU3GfDVemRnTSnHHf44Hrd5ERb6vhX4-1J8eBmO3Udm0E6OaTpeJH-XL6ZTJMxxXuhDxhnOPBiAEYTNfHkS48Cixk_6AjwmvNdG0JOzRlmwXJ_HmqFoDrd1OeL40i9nB0XMO6RuerbMOx6d5cSdYfBekAofS9QnWjPixSpA2SN8rUiyVZSTl5a7y3hMRx2H877We04x5EgQ9jsOXlMboDXSZPc1ODbeFfJoMaMffZa7-cMIqig97J9xXhXOewdxgfEe8PFnzwu1w2XvPSYHBNtGEu2Sa7YC89WZIg"
+  "refresh_token": "eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA5MjA4NjUsImlhdCI6MTU0MDgzNDQ2NSwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo1MDAwL21ldGFkYXRhIiwibmJmIjoxNTQwODM0NDY1LCJhdWQiOiIyMDk5MDg3YS0wN2ZmLTRlOGQtOWM4YS1iZmY1Y2Q2N2UwZGQiLCJqdGkiOiI5Y2VmNzdiMy02NGRhLTQ5MmItYTM5MS1hYTY0YjExMDFjMjAiLCJzdWIiOiJlMDcxZGRhMy0wZjVhLTRiODktODkxMy1kNDdmM2UxNTE3MTAiLCJ0b2tlbl90eXBlIjoicmVmcmVzaCJ9.aJP9Hwh2U1NqRaFn10kheLqZplgi2c194jD8wfBcTCkV4sijc7_GxvsdIEl3v6zVoOHOfop4D9P6Qa4NQkwzhLe1bzr3liAu74ZPJOOlhRX76uah_cx6BqofHwqAMOvPg95q05wF79g6trPYPuKm6-Mlm_vdN9E3wZzrJXKZBBhWc-L28KXF3NJ4xRQW5NRT346pTgWaeLVv1LMDEGDagG9JfvfcEu_2ThVqfQwPMfcpwqGBdjH4ReDkT0hN4407dGeKu4MUIZyJjvUQiRzg2EAoPR3iFGylInmlpQcVlyF7sihzgRFJiEZEB3KBMi7GLasX43lQ3dJ3GeNjgcAPToCoLniwpK4KkaIyE9OjGguIep17OGF1NpOYUKLxuJo2yN_EH4v2B8juBCEnDr0g7ETmT7ZFgZIyjKWOn490-r8IaOJbGejZGcloKgQ04lALvK4RqlA-ruhWcfHAhk60DEzNf6C5FAsGyuA8Zs21UPCptCF90V_k6sgmPYgWlS4bswBVQXUVWJFHhLYehy7L7PRSgho4k2rU81OxrPrwZovM4Ljj1-rKoygR3UMwJ760EYd2oEmLcPjLyyqoWJKvu-bueiRQDJW09ORzUUU92YrHNCcLhRx5tlcvR_bUUp97XDnfy0slRvuAmIQWEr82yCvUNOHDRHdkEYWAZj_5hgc"
 }
 ```
doc/_includes/oauth-tokens-client-credentials.html
@@ -10,7 +10,7 @@ $ curl http://localhost:5000/oauth/tokens \
   -H "Accept: application/json" \
   -H "Content-Type: application/json" \
   -H "User-Agent: net/hippie 0.1.9" \
-  -H "Authorization: Basic NDRhODMwNmItZTdiMS00MWNkLTkzMjktMTU1MmY2YTRhMjhlOmdtaG1xMllreXVETDd6bmtlZnlicUNtUw==" \
+  -H "Authorization: Basic N2RiMTNiNzYtMmZhNC00OWJjLTg0ZDMtOGMzNjg0OGY4NjBjOkRocmZISkRYZzhERHRVSFBUTTJCeFZ5cg==" \
   -H "Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3"
 ```
 Request:
@@ -18,7 +18,7 @@ Request:
 Accept: application/json
 Content-Type: application/json
 User-Agent: net/hippie 0.1.9
-Authorization: Basic NDRhODMwNmItZTdiMS00MWNkLTkzMjktMTU1MmY2YTRhMjhlOmdtaG1xMllreXVETDd6bmtlZnlicUNtUw==
+Authorization: Basic N2RiMTNiNzYtMmZhNC00OWJjLTg0ZDMtOGMzNjg0OGY4NjBjOkRocmZISkRYZzhERHRVSFBUTTJCeFZ5cg==
 Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3
 ```
 ```json
@@ -33,13 +33,13 @@ Response:
 Cache-Control: private, no-store
 Pragma: no-cache
 Content-Type: application/json; charset=utf-8
-Etag: W/"2b68c6818487e11d107ae812ad7d2089"
-X-Request-Id: 2a614b6e-6cd0-45fa-ba7e-ce0d118c7434
+Etag: W/"759ec4a53437b1135803088e1b3b0ce7"
+X-Request-Id: 2fd0d33c-174a-4f4e-9413-01399836391e
 Transfer-Encoding: chunked
 ```
 ```json
 {
-  "access_token": "eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA3ODAyNTIsImlhdCI6MTU0MDc3NjY1MiwiaXNzIjoiaHR0cDovL3Byb29mLnRlc3QvbWV0YWRhdGEiLCJuYmYiOjE1NDA3NzY2NTIsImF1ZCI6IjQ0YTgzMDZiLWU3YjEtNDFjZC05MzI5LTE1NTJmNmE0YTI4ZSIsImp0aSI6Ijk4M2E2MzYyLWZiOTMtNDQ2OC1hMzI3LTJlMzIwNjUwZTMwNyIsInN1YiI6IjQ0YTgzMDZiLWU3YjEtNDFjZC05MzI5LTE1NTJmNmE0YTI4ZSIsInRva2VuX3R5cGUiOiJhY2Nlc3MifQ.a45vQg-7A10nRpm10-7V-IbH5PFhl3OMwOn7nVaWBM5T75UzGWM96ZAlejso8-2wfPNRI_yrx6CEB9tJ-1oKe4uxAquArPmqTZ45LUnFVaCiVWoyT_3emUM7Ej14t5U3L755iR_jhooWfxdaDdTFzTlgHy5wlRg6CBjnHpk7Ng8pv-d7Bfio5BvUmDPhjxDd3VV4F5aIf2l9HRVTU_PJDGYRTqArcsalAqpNPipeMHJzVf_AqN-oOo6M81R0nP4tjSGoqKeZL2JhVytq6acdPNjxce90A2K4a9fSGp-fkGlTuPENUxLJJVonYR5N0oaBHZfC9HNF-qsKAw7ybSjwwg",
+  "access_token": "eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA4MzgwNjYsImlhdCI6MTU0MDgzNDQ2NiwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo1MDAwL21ldGFkYXRhIiwibmJmIjoxNTQwODM0NDY2LCJhdWQiOiI3ZGIxM2I3Ni0yZmE0LTQ5YmMtODRkMy04YzM2ODQ4Zjg2MGMiLCJqdGkiOiJhNDgyYzNkMy0xNjRjLTQyMzUtYTE0Yy0wNzQ0MmNjMTMxNjgiLCJzdWIiOiI3ZGIxM2I3Ni0yZmE0LTQ5YmMtODRkMy04YzM2ODQ4Zjg2MGMiLCJ0b2tlbl90eXBlIjoiYWNjZXNzIn0.HBtrGSZIGiBJ1_IK4lGlKmfKKiM5OpLEIKacxu2V-4zhyOo-J_AZFJzSVg5AbpcDvKubuZxk2SZ8Xyuf62qSAo1SWWr1AA8H2mmVEl9dRUkjuEfOazf61qmIm0BJKyDayv7gSTsoz6rY__Pms4FnjUQ_mhbnBckkaxTomX4J3MY-bWs6RfsEBK1HRTCIqV_k9JHdXmIGA8kP9Ds18J7nlBwnqHdgAEYFy9TOWXPABdsSNsZZb89tRbylOgfXbmkmoOwqWukeL5BRd_k4ryn2D1d3caSXfA17l6oqQbJ9vIm3N_0lOpl8H_BSUYDa2IWXh2chUnDCPPCWuR0njhj0OqjT7ptw7HjtnA9tzGyfkgSmh-3gGZVUwcyB_t1B-cZWYs97UrT_m4Ii9EnWGO3b0megvQPbXM2Y6RR59cl_dyAM-U_bCmOl8UR9WDT7ZCiuyJy3MQna1CvwEcmnH6NROPkuuojRMzu2aHEnIUdP9zym_08qvBqifiYTXbI2NgGBl3J1bm9OrUFySBSmik0NbR4Jnie_D9L3V-H3K_X0aKRGe3kiQBXmAZOC3vK9Pb0i6DVVxxmSvn2q-oKA25vbQixvalL2vDQ7AF99SDbZwbx7dArPI1hi1w_CPY3pWlq6eBsH5Z5F6aeYh5EwdKxgMaiAfXXS3alyWmdly7Qc1rA",
   "token_type": "Bearer",
   "expires_in": 3600
 }
doc/_includes/oauth-tokens-password.html
@@ -6,11 +6,11 @@ Example curl request:
 ```bash
 $ curl http://localhost:5000/oauth/tokens \
   -X POST \
-  -d '{"grant_type":"password","username":"nam_weber@skiles.com","password":"lYrrwBRbeYls6FEM"}' \
+  -d '{"grant_type":"password","username":"jody_pouros@collinstremblay.com","password":"R1Fxyn194FXorN"}' \
   -H "Accept: application/json" \
   -H "Content-Type: application/json" \
   -H "User-Agent: net/hippie 0.1.9" \
-  -H "Authorization: Basic ZDMzZWE4ZmMtMTExYy00Y2RjLWIxMzYtMGMzNjBhNzhhZjM0OjZveVo4cDJpSEFiYzRrZUVxRVBFOWprUA==" \
+  -H "Authorization: Basic ZTdiNzc5YTItNWUyNS00MDY5LTkzZTktNzZjY2NkNWEwYjJhOndYenk2REczMUhvRTJraVNMcTV1UktjOQ==" \
   -H "Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3"
 ```
 Request:
@@ -18,14 +18,14 @@ Request:
 Accept: application/json
 Content-Type: application/json
 User-Agent: net/hippie 0.1.9
-Authorization: Basic ZDMzZWE4ZmMtMTExYy00Y2RjLWIxMzYtMGMzNjBhNzhhZjM0OjZveVo4cDJpSEFiYzRrZUVxRVBFOWprUA==
+Authorization: Basic ZTdiNzc5YTItNWUyNS00MDY5LTkzZTktNzZjY2NkNWEwYjJhOndYenk2REczMUhvRTJraVNMcTV1UktjOQ==
 Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3
 ```
 ```json
 {
   "grant_type": "password",
-  "username": "nam_weber@skiles.com",
-  "password": "lYrrwBRbeYls6FEM"
+  "username": "jody_pouros@collinstremblay.com",
+  "password": "R1Fxyn194FXorN"
 }
 ```
 Response:
@@ -35,16 +35,16 @@ Response:
 Cache-Control: private, no-store
 Pragma: no-cache
 Content-Type: application/json; charset=utf-8
-Etag: W/"cbc93469ceacc8fdf1c7e4e8f5009a89"
-X-Request-Id: a22b4125-0084-425a-8e2b-741378a16d2c
+Etag: W/"b8984c3accd1ca5eff541d9003329cd2"
+X-Request-Id: c1acb50d-57dd-48ba-b90f-05ffe3e67321
 Transfer-Encoding: chunked
 ```
 ```json
 {
-  "access_token": "eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA3ODAyNTIsImlhdCI6MTU0MDc3NjY1MiwiaXNzIjoiaHR0cDovL3Byb29mLnRlc3QvbWV0YWRhdGEiLCJuYmYiOjE1NDA3NzY2NTIsImF1ZCI6ImQzM2VhOGZjLTExMWMtNGNkYy1iMTM2LTBjMzYwYTc4YWYzNCIsImp0aSI6Ijc1MWE5MzJhLWM0NzctNGFhNi1hOTFjLWE0MTdlYTY0YmFhYiIsInN1YiI6Ijg2NTg2MGY2LTZiNTMtNDMzNS1hMzZiLTc1MDZjZGJjZjc2MCIsInRva2VuX3R5cGUiOiJhY2Nlc3MifQ.aYybc1gyGWvRFXTCldlJGm2dIFhnWzwbJIJ-_xIRiZsVYIGJHsEUN9h8hu6CQzvj7rmaLg48deTlROlCEQA0NBvBO6ar3TZpTJ-1cN2q1qKlDGce-v_yKoRxygvmpNXCwI7CzwrrJ8RTIUqOLb_-F7cPb1GXSTKWwS4WH293Hr-oMwQLkyFGM5qClSpH3Duj2iYUO9wgehz5Uz4yW_pwFAd-if4B6ZqDz42OHHeFrreB-ErfZcfHBW_QqTmiZmyU1_DbaGL0Att5RyFRugN7_o8WUHfcax8QyUOJJ5ZLRu1EnPhCFXRM57wFTrotsAosnHOuK2JOvSQNWc2tvgaHsQ",
+  "access_token": "eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA4MzgwNjUsImlhdCI6MTU0MDgzNDQ2NSwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo1MDAwL21ldGFkYXRhIiwibmJmIjoxNTQwODM0NDY1LCJhdWQiOiJlN2I3NzlhMi01ZTI1LTQwNjktOTNlOS03NmNjY2Q1YTBiMmEiLCJqdGkiOiIyYjQyZDcwYS01NTRlLTQxZDEtOTliZi1mNGFjNTkxYzYzYTkiLCJzdWIiOiIwOGRkNzkwYy0xYWY2LTQzMGQtODcyMi1hNTQwMjdlZWM4NjAiLCJ0b2tlbl90eXBlIjoiYWNjZXNzIn0.MuiC0Ft-jzzUbfNT1rowj4ihKodGDYLqrXY0UKcbkygnKJZunL3eGIwXU_aY_xBMObvmbAuRkbzmS5caClSQatShDMWPpgEhDoKeVjovDQP9zSIaVzQfz_QDeeEdkIVIjf66oTCtjRnEns9tNmWLXT0Q8rVcdgiNvxk_AnBPejB7A3xH5ck_ae9A8wV6Kx7Ysv_WviXvRFJByNTYLYT_Z1ZC2-hgXjQCTV2mpuVy-zHbbWDNMvvNIRn4eOX2nsJ8zopCdnr1zSiOmfDPlTUZYhbZbHLnDwvdjJe3AOqft_x71Xlcz8xhkkgGt2u2gM0ZaJxpgUow0L45UpXlzV9s5ZqcGNDXbfB-q2C7BoBAz8dyHHYvP2eP3BIqSsMUeUAO5hnSxj74a0QDpqqNZQqO9Gc9Cdu2Wk6_wNs-m0EpARNGBSyH6GA0CYFdpk5Aui4AVt_5_nZnfa9LWp7_FQlqao-J0UXzf2m0fuFwp6KpAhBYYljEpJqIGlR4lq38R7bfnrkemxQyJfZYQDV0vIzBkFUOaauWK3al245VsFOtwKlStY-ix366d55vepO4008A0jRDuknUoI15sNlGwsL36e8oVWHI6DEUVoVHQcVUeYBUzcPLicQbngD7CCPfekoIQalaSKjmT96Q0IYt6WgI8hSPrbZWISq9K2h5sQTcEzI",
   "token_type": "Bearer",
   "expires_in": 3600,
-  "refresh_token": "eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA4NjMwNTIsImlhdCI6MTU0MDc3NjY1MiwiaXNzIjoiaHR0cDovL3Byb29mLnRlc3QvbWV0YWRhdGEiLCJuYmYiOjE1NDA3NzY2NTIsImF1ZCI6ImQzM2VhOGZjLTExMWMtNGNkYy1iMTM2LTBjMzYwYTc4YWYzNCIsImp0aSI6ImM4NjdiODFmLWNlY2ItNDI4MC04Mjg3LWUyZWUzODQ0OWJjMSIsInN1YiI6Ijg2NTg2MGY2LTZiNTMtNDMzNS1hMzZiLTc1MDZjZGJjZjc2MCIsInRva2VuX3R5cGUiOiJyZWZyZXNoIn0.cuhoJpiz8kClLpWExODSQNOQyIUoU3cejOQIETIth_Jrqpmc_J03E1EmpVjyXacCoYpqVW2WUnJAlVXQCvjpgQHFCZWmpnMyQ7o0okf7_sbnXEF2ZIBQM4ZYkMlycebmTvIjbs6sdazAnmeg6QC1hy1rFhkf9yVgR2WieR6V9EtFYZN6LQ-6Ku80_cGM3VtsXeUviW2fA266aqkAx-NfJxSa5g3dehdHUSpTALK4ynoqe_qkCMQ2gBBjbuXdl80PTJLFezZYmvNXjYPWXgG4cXompN-pg1JGMYJLTRn_zJdjkHLpMcej835WU_R1qQdK4ZVO3LgB0OZ2kNwvRy0s6g"
+  "refresh_token": "eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA5MjA4NjUsImlhdCI6MTU0MDgzNDQ2NSwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo1MDAwL21ldGFkYXRhIiwibmJmIjoxNTQwODM0NDY1LCJhdWQiOiJlN2I3NzlhMi01ZTI1LTQwNjktOTNlOS03NmNjY2Q1YTBiMmEiLCJqdGkiOiI4YWNlODI3Ny1kMjk4LTRhMjMtODUzZS1lMDlkNTBmMGIyZjMiLCJzdWIiOiIwOGRkNzkwYy0xYWY2LTQzMGQtODcyMi1hNTQwMjdlZWM4NjAiLCJ0b2tlbl90eXBlIjoicmVmcmVzaCJ9.JIneXL2IdVEfeyOnunU8r2SuEFzGMLdHtOFtnYc36JOklUxv3zbUqthx3wclLU3jOQpv_DzfT9AIwXDE_Kgscpk8oH53VmopexTGfJa8xxAnwaAzVc9-qKzyiAYa3iUp0TC5qW7Jpac3l6JJ1k3JMTYT7kvFKUoUdSxfCvJTiGTubJgujTYCfktPVckR6XloNnipz4DNHYoBbnBfhljIG681AtxPRKTtbfMosu7RH01jYiSKNTHsOR8mQBmLOV3GjSP6u_tPRb5GsgKPzNf2LnySyjIKpy2U0l6CjUyM-TuaMKZ6qF8JjFT5evIoanS5enRcyHO0lR8ngd3XB-57HdQ5K0toiGhTK7eGYFXjkSjOTpj1H-dfXUN9QUJNCE9GC-IP8n3oE_hohHQooc-94K3VtbtpCjNDvpYJ3vGlpky96rHGz3Ru6rvO0UCEFTMdAt3b0rBjzAsrIk7R22j4mrgDMGLNeil_sWW4lbh80t5VVkh3hhFSeoEnw0ce-1F0ElWRT1rGyM4zBd9IMKox-rkOyBDEHdMErGxAuVx8falNkiuVUmz6MJ7ohufY_xm9No4Q9EtXaspeaukzDxpX5gOzW7H3fJ32Gcwa69TA17OHaie0yfCUOJQ8tshzX2XRnagKwv0BCZiVKFd2T70jRJaxeEtnthOtX6j2Y7I6NLE"
 }
 ```
doc/_includes/oauth-tokens-pkce.html
@@ -6,11 +6,11 @@ Example curl request:
 ```bash
 $ curl http://localhost:5000/oauth/tokens \
   -X POST \
-  -d '{"grant_type":"authorization_code","code":"Lq7DEsSVb843Nze1tncAfwTg","code_verifier":"cd80c42f06c46536d655554d2f63ae2e6f03b0527a926e3abecc60ddad3a2f3d6d6afec7a449dfa6a7658b56807d9fa03687238ce860d7d90a00e262f4cb66aa9483aaddf41e53769e453c487f9e179a8f12f325c83c28601b6e37105d007cdfdb265bb50b405c0acef7c0d7bf91656784708dfd18b249a9be21cb3c5aa1d71b"}' \
+  -d '{"grant_type":"authorization_code","code":"MzWqtCmqducBvHJf8oHAa5Q8","code_verifier":"e11b04b3fa15413a4584672783604fca5997db8dbda4b2a2bb7046c5645c462a3326bdfb5974bf9644a3b239923253143686ed7d18aca9f83528a0581afaf9cfbf1bc5aa609828c2c9484c92f8be52e0c4e1637261f71303d4160689f378df9bf4773f6ceaf1e2da18f05965a86b796ed4179bfb223205fb83a20b6f6d0411e9"}' \
   -H "Accept: application/json" \
   -H "Content-Type: application/json" \
   -H "User-Agent: net/hippie 0.1.9" \
-  -H "Authorization: Basic ZGQyODliOGQtNGNlMC00OWJkLWIyM2MtNzliNzZiNDVhYTE0Okp0NXJDU1B6WTJQWWhEeUZWMVh3bVBZdw==" \
+  -H "Authorization: Basic NzA1ODUyMTEtOWNlYy00ZGNiLTg2M2ItYmNiOWNmYzU2MjY3OmJZRWNqTjRrMlhmZk5HaVhQb05rc1RoaA==" \
   -H "Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3"
 ```
 Request:
@@ -18,14 +18,14 @@ Request:
 Accept: application/json
 Content-Type: application/json
 User-Agent: net/hippie 0.1.9
-Authorization: Basic ZGQyODliOGQtNGNlMC00OWJkLWIyM2MtNzliNzZiNDVhYTE0Okp0NXJDU1B6WTJQWWhEeUZWMVh3bVBZdw==
+Authorization: Basic NzA1ODUyMTEtOWNlYy00ZGNiLTg2M2ItYmNiOWNmYzU2MjY3OmJZRWNqTjRrMlhmZk5HaVhQb05rc1RoaA==
 Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3
 ```
 ```json
 {
   "grant_type": "authorization_code",
-  "code": "Lq7DEsSVb843Nze1tncAfwTg",
-  "code_verifier": "cd80c42f06c46536d655554d2f63ae2e6f03b0527a926e3abecc60ddad3a2f3d6d6afec7a449dfa6a7658b56807d9fa03687238ce860d7d90a00e262f4cb66aa9483aaddf41e53769e453c487f9e179a8f12f325c83c28601b6e37105d007cdfdb265bb50b405c0acef7c0d7bf91656784708dfd18b249a9be21cb3c5aa1d71b"
+  "code": "MzWqtCmqducBvHJf8oHAa5Q8",
+  "code_verifier": "e11b04b3fa15413a4584672783604fca5997db8dbda4b2a2bb7046c5645c462a3326bdfb5974bf9644a3b239923253143686ed7d18aca9f83528a0581afaf9cfbf1bc5aa609828c2c9484c92f8be52e0c4e1637261f71303d4160689f378df9bf4773f6ceaf1e2da18f05965a86b796ed4179bfb223205fb83a20b6f6d0411e9"
 }
 ```
 Response:
@@ -35,16 +35,16 @@ Response:
 Cache-Control: private, no-store
 Pragma: no-cache
 Content-Type: application/json; charset=utf-8
-Etag: W/"a5601f3778ea5b606e2ab3b58f16329c"
-X-Request-Id: 803b2904-3efa-42bf-aea1-59640a2fded7
+Etag: W/"9bf15031b2fe93f0204fde609f9dab14"
+X-Request-Id: b9ae0302-7432-42ee-a469-8a761f008530
 Transfer-Encoding: chunked
 ```
 ```json
 {
-  "access_token": "eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA3ODAyNTMsImlhdCI6MTU0MDc3NjY1MywiaXNzIjoiaHR0cDovL3Byb29mLnRlc3QvbWV0YWRhdGEiLCJuYmYiOjE1NDA3NzY2NTMsImF1ZCI6ImRkMjg5YjhkLTRjZTAtNDliZC1iMjNjLTc5Yjc2YjQ1YWExNCIsImp0aSI6IjZlZGI2OTA0LWJjMzItNDAyMC04MTRhLTdiNGIzYjJhN2UwNCIsInN1YiI6ImQwOWIxNzhhLTdjZGItNDkwMy1iODFlLTExZTZmMzI1ZjUxNyIsInRva2VuX3R5cGUiOiJhY2Nlc3MifQ.ca4lAXIldU7zPo7WtvBjdukpU3MzC7WY3J2BDMyr7-kaL7_QtGNK7KNPoF-fD0bBFTGarwrar5Z2bDBQBK0oPbPnBG9iOl7uExIP6_iU-zPYD7daP7gdFSZKk_aVP2pj3ccG-zUMgx1Py0y_Pt5LP624D4yE-lwZV0B32EIg2ZSS9WbVIuQ5A8riUO4eN2Vw9fImicLifnsSx8mvyTc_Gwg5FfiLWfb5Zs7OxhM-4fAkk-7q1BBJCiOVoSA6khaaxhlPm-1lBoSeKlhau73e3f7M08_8VniPe7EZouqD5zyfMr7IORHnSchrYXJSZVrInYcDN8bxrQn3kP1M_XOjsw",
+  "access_token": "eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA4MzgwNjcsImlhdCI6MTU0MDgzNDQ2NywiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo1MDAwL21ldGFkYXRhIiwibmJmIjoxNTQwODM0NDY3LCJhdWQiOiI3MDU4NTIxMS05Y2VjLTRkY2ItODYzYi1iY2I5Y2ZjNTYyNjciLCJqdGkiOiI0MDUxNzA2Ni1mOGI4LTQwMTItYWNiYS0xNzRjZTUyZmQxNzEiLCJzdWIiOiJlNjJjYWQ5Ny1jMWQ0LTQ3MDAtYmRiNi1kNWRmNGU2MTc4YzkiLCJ0b2tlbl90eXBlIjoiYWNjZXNzIn0.bQ9ixhyM9A-g6k1edxXoJ57ShVMC7kGZ6E1Lm9z_R6qdgZdBjjYKblerLpQ7azwf9Qkku9VYXV00oqxfX-S9LkuDK_zK2xUG29Zuu9X-QX_EIIxoouOIYHmMy5Y9INr17k50bQTyaI8popweQXkQ1dEFbBlMctAxyZxPn8rSJRMi9sM-O6B_wIQUZuscTZniJjpssuIoU9M9oqHMuQ6xtw1SYBDo7xnn5X0kVV1HThVdlI-i-6r0buiL1_qZj6d8NVHjBY6PonGeSgmxnWM9om2UdGjjD6b83H8bmNXyv8TXhrCWd7b-HKTF_yBV5NVRl1varsrFCf5fmO6VqJAEynbZ5PQBv00uzPt0Jm0zm5DZqtZeHP8NH56_F7McaX0EXN3apuGkGhqTkSF6LV0LFAxHyazib2b-NLbwYZcm4EtvzeZfo-ocby8KaAobBbgB10oUfSb452w9JiiUgqWYmh3ilOT6DYy_Xz81MZi-wTb1tRnhtUYi6pSBkCP-i5VCqEFD9XBtEbHUFPywjDoRErFpaYsnVywFTjQ8Z7VBHE6I4bMtUi5tV8Pupwfxn85DdfzaHZSwH34xWXn48NoUv15Einuyat6wcuHCzAcP79eMWEB5zAoOmBKQmcJuis0hxQdqaCvhpqENBUxFucsBnFvI2jPCm1nRUnq5hYtCrMI",
   "token_type": "Bearer",
   "expires_in": 3600,
-  "refresh_token": "eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA4NjMwNTMsImlhdCI6MTU0MDc3NjY1MywiaXNzIjoiaHR0cDovL3Byb29mLnRlc3QvbWV0YWRhdGEiLCJuYmYiOjE1NDA3NzY2NTMsImF1ZCI6ImRkMjg5YjhkLTRjZTAtNDliZC1iMjNjLTc5Yjc2YjQ1YWExNCIsImp0aSI6IjBiNjJkYWZlLWNkNmEtNDIzMS1iNjNjLTg5NGE0MTkyNjM0YSIsInN1YiI6ImQwOWIxNzhhLTdjZGItNDkwMy1iODFlLTExZTZmMzI1ZjUxNyIsInRva2VuX3R5cGUiOiJyZWZyZXNoIn0.PjBhZchI3Mb_EdtjHs1f30f2i_xGYVi-6OHUQK4DvlvtUxLlz4neecKG00hvcoAxOEz5ZaVbbUeffC0NGh0uGs6CXr3p1W-TzPcSc0b1GbttXqXXYalqtjgQD0z5ZzPVVgNjQ04xRXOEUgXO06NjV97rKl419eNmnHwp5WiG8VR7FYEUN6o1vlbRswD38UVuUY0X46MhBKbW1dMfpmeeBmKBZknmUIc30mx1ofPDjsG6ZM9EsEbQaKEtVH0-G-0OeWOj4JBi9xsCJ_ix0L2CvahiyT6AfEep9ySFDNBj0-jykOk8aiGVKPN_aNhI3FX03gsqauT3QUgokisuauv7EA"
+  "refresh_token": "eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA5MjA4NjcsImlhdCI6MTU0MDgzNDQ2NywiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo1MDAwL21ldGFkYXRhIiwibmJmIjoxNTQwODM0NDY3LCJhdWQiOiI3MDU4NTIxMS05Y2VjLTRkY2ItODYzYi1iY2I5Y2ZjNTYyNjciLCJqdGkiOiI1OTlmM2M3Yi0zMGUxLTRhMTQtOTEyOC1kNmIyZjMzM2Q1NmMiLCJzdWIiOiJlNjJjYWQ5Ny1jMWQ0LTQ3MDAtYmRiNi1kNWRmNGU2MTc4YzkiLCJ0b2tlbl90eXBlIjoicmVmcmVzaCJ9.oVQlkcY4BTy-l-pum5chylx5SE6OONt6jomWZTS2CaqwQncvGRszPDNd8-OXm9IzC3Q0WA-e-zxwVJb3w6yx9t2X9rBC8Q0F_-Lk_yysnPOvWgkqvJdF9NkICxPCVufbZkSZjdwgvqsKjjzlXEHy8axR9C6yLmkZN_XBFF7GRC5Owqm79zrrAdvxeR2L9yiYgDILHnWbOi1iRbAmz0yZNLwYvwBXnJdfiMm4BaoWY_xrcrf7dx2rVLBU-dZyRFWSG0qG2PljxXY5_y5K9AVIAiGBy0JciIiuI2hePaGD-L_QzDeAtDuV6eA5le8Ja3xUWXT8vgxG1tTAAjw_IdOF18P2vZLcemsAzGuXom4qq9dU46t4p9bkdQuKLUEVpmuA9O1W__jwnr5zfBHLC__40v-6npUhW2VBr9MX_9MNAWoYL6EkRwgos-WC52LF20iS6miVUPwnL6OJobgGz8fDkf7i7opzAtfepjoF-ZzflgZHVmvNN75xoRSlM6A8aY9JcsBLsLgztwVAGCD1l0efkmEh0DgZSURvRCe4ED6sno2GW_QhrnM19uNmbbqNTP9slR7Tw4FVdDuld4358qsbNXCcPCFVixNMzos7mkyShKdfcBdH6T5ad3jJiep2LITXUWOIujIX73Bv75nn1AKWyjRzjUaf1KSlIcQtkea7DqY"
 }
 ```
doc/_includes/oauth-tokens-refresh-token.html
@@ -6,11 +6,11 @@ Example curl request:
 ```bash
 $ curl http://localhost:5000/oauth/tokens \
   -X POST \
-  -d '{"grant_type":"refresh_token","refresh_token":"eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA3ODAyNTMsImlhdCI6MTU0MDc3NjY1MywiaXNzIjoiaHR0cDovL3Byb29mLnRlc3Q6NTAwMC9tZXRhZGF0YSIsIm5iZiI6MTU0MDc3NjY1MywiYXVkIjoiNjA5NWRkYWQtNWE2OS00NWFmLTgzZWMtYmRkODc3ZWUxZGRlIiwianRpIjoiNjU4Y2JkMGYtYTRhYy00YjFhLThjMDEtN2Y0NWNiN2QyZjgzIiwic3ViIjoiNDUwNjE5ZmYtZmM5Ny00ZjY1LWEyODMtZGYyZWY5MGRlMzJjIiwidG9rZW5fdHlwZSI6InJlZnJlc2gifQ.TOnHZuDK56fhXpppv395LpHgfKBRsmc8nYwCVxrcloOEieVDDzPb6Xyc8aRrbUoXoJUig27krRKpSkz0c_8DRiSKgwWU_M0OcFAPMFEe-Bw1hzKJvg7Ww8DoWa-RL6fCnORk67pCYWcI6R1OWrofgz5K-_uS47xGa2Y5KMKPiuD0feh8aJxK8gbLWAYMnQrRK_A6_8dPOdN_C-LFEcuvgy00YTD_5UuV7s_USV_5QwbC_DWMnsg2WDHHCVdVj01jXB5_MsJfm8HHgl0ZmO6f_mnnPDtbZlRXRFmaMlg54pc2EFtsbFbH470YLnHSQUmz3zCPMhAYti00qWDDaGpMxQ"}' \
+  -d '{"grant_type":"refresh_token","refresh_token":"eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA4MzgwNjYsImlhdCI6MTU0MDgzNDQ2NiwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo1MDAwL21ldGFkYXRhIiwibmJmIjoxNTQwODM0NDY2LCJhdWQiOiJhMTE5OWQ3Zi05NGJkLTQ4YWMtYTUwMC04MzFiMzVkMzZkYjIiLCJqdGkiOiJkNWQyN2UwMi04OTgyLTRjMWUtODYzNC05NzdiODkyNTRjMzMiLCJzdWIiOiJkYmVlYWMwMi0xN2Y0LTRlNDQtYTU2Yi03NmIwZGYyNjIxODYiLCJ0b2tlbl90eXBlIjoicmVmcmVzaCJ9.fNgy41rrE45L1rJwbdPbmK8ZfHbXdTqJK1GQ9kSn2OpSnM2iTbkoedTxrhldgxIckgc5kqrcfYCq4BDUI1o2ZMGp3QQC-HTNjShwejkLvQPYoJA4JShE1Pfo0zpqOHajvntuuT_EJ4A5ukuFtt0vHrpI58jObhxD1Gm4kDGjt014X6IGtuQ7ecbfWnF3Xu6s4N4f1eQzh_ITP3of4-m7Aof_0XZAwnx5mV6DMDt20ZKFki4aMZBgXqklohlDl-KTfpo_rllrXNxgO-L0TXGeBkk5KZgTUaFtI9SbMcTHpeaT-cL_E81Q4w6EeO7naohw_Vio5wA4sXgpCo1RBdNXvoedaauKKyN6jduRHsUGZDKN4gsilDs7wQs6s8aOWKhNlIF-CrSABnD9moaZDyvWgbewW4DdCWlT7Kez8dtItj9YTweHZX5ZHInrMOJPrXnUwA5LYYu0wEfBWkKevTAz8hZl67U7JPlP1z1gyHtLPHB-6ZceUm4hCHQwJGT7ouLZ--SSU2VkxQPOgrAFfH7xF2N8PL-Vl0mBqLSbUFCBYPMZRXusEN5UBhDxfGxQjUKSSV8QgUMBMRbWxuShHeyklnPYfyQi8ONaNqmcfFNVa9Aa1X1xAcQsWPCEeWpeFhQlz6RsTzN-znCTW-_xAT4y_AE9CLN3kRlUJKzIg__K7zU"}' \
   -H "Accept: application/json" \
   -H "Content-Type: application/json" \
   -H "User-Agent: net/hippie 0.1.9" \
-  -H "Authorization: Basic NjA5NWRkYWQtNWE2OS00NWFmLTgzZWMtYmRkODc3ZWUxZGRlOkNFWnpLWG80NHllYkZRYVp5TDFxc3Ryeg==" \
+  -H "Authorization: Basic YTExOTlkN2YtOTRiZC00OGFjLWE1MDAtODMxYjM1ZDM2ZGIyOnU0VkdDQ0ZoNG5HN2NzdHZQd2NjeEp5ZA==" \
   -H "Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3"
 ```
 Request:
@@ -18,28 +18,32 @@ Request:
 Accept: application/json
 Content-Type: application/json
 User-Agent: net/hippie 0.1.9
-Authorization: Basic NjA5NWRkYWQtNWE2OS00NWFmLTgzZWMtYmRkODc3ZWUxZGRlOkNFWnpLWG80NHllYkZRYVp5TDFxc3Ryeg==
+Authorization: Basic YTExOTlkN2YtOTRiZC00OGFjLWE1MDAtODMxYjM1ZDM2ZGIyOnU0VkdDQ0ZoNG5HN2NzdHZQd2NjeEp5ZA==
 Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3
 ```
 ```json
 {
   "grant_type": "refresh_token",
-  "refresh_token": "eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA3ODAyNTMsImlhdCI6MTU0MDc3NjY1MywiaXNzIjoiaHR0cDovL3Byb29mLnRlc3Q6NTAwMC9tZXRhZGF0YSIsIm5iZiI6MTU0MDc3NjY1MywiYXVkIjoiNjA5NWRkYWQtNWE2OS00NWFmLTgzZWMtYmRkODc3ZWUxZGRlIiwianRpIjoiNjU4Y2JkMGYtYTRhYy00YjFhLThjMDEtN2Y0NWNiN2QyZjgzIiwic3ViIjoiNDUwNjE5ZmYtZmM5Ny00ZjY1LWEyODMtZGYyZWY5MGRlMzJjIiwidG9rZW5fdHlwZSI6InJlZnJlc2gifQ.TOnHZuDK56fhXpppv395LpHgfKBRsmc8nYwCVxrcloOEieVDDzPb6Xyc8aRrbUoXoJUig27krRKpSkz0c_8DRiSKgwWU_M0OcFAPMFEe-Bw1hzKJvg7Ww8DoWa-RL6fCnORk67pCYWcI6R1OWrofgz5K-_uS47xGa2Y5KMKPiuD0feh8aJxK8gbLWAYMnQrRK_A6_8dPOdN_C-LFEcuvgy00YTD_5UuV7s_USV_5QwbC_DWMnsg2WDHHCVdVj01jXB5_MsJfm8HHgl0ZmO6f_mnnPDtbZlRXRFmaMlg54pc2EFtsbFbH470YLnHSQUmz3zCPMhAYti00qWDDaGpMxQ"
+  "refresh_token": "eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA4MzgwNjYsImlhdCI6MTU0MDgzNDQ2NiwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo1MDAwL21ldGFkYXRhIiwibmJmIjoxNTQwODM0NDY2LCJhdWQiOiJhMTE5OWQ3Zi05NGJkLTQ4YWMtYTUwMC04MzFiMzVkMzZkYjIiLCJqdGkiOiJkNWQyN2UwMi04OTgyLTRjMWUtODYzNC05NzdiODkyNTRjMzMiLCJzdWIiOiJkYmVlYWMwMi0xN2Y0LTRlNDQtYTU2Yi03NmIwZGYyNjIxODYiLCJ0b2tlbl90eXBlIjoicmVmcmVzaCJ9.fNgy41rrE45L1rJwbdPbmK8ZfHbXdTqJK1GQ9kSn2OpSnM2iTbkoedTxrhldgxIckgc5kqrcfYCq4BDUI1o2ZMGp3QQC-HTNjShwejkLvQPYoJA4JShE1Pfo0zpqOHajvntuuT_EJ4A5ukuFtt0vHrpI58jObhxD1Gm4kDGjt014X6IGtuQ7ecbfWnF3Xu6s4N4f1eQzh_ITP3of4-m7Aof_0XZAwnx5mV6DMDt20ZKFki4aMZBgXqklohlDl-KTfpo_rllrXNxgO-L0TXGeBkk5KZgTUaFtI9SbMcTHpeaT-cL_E81Q4w6EeO7naohw_Vio5wA4sXgpCo1RBdNXvoedaauKKyN6jduRHsUGZDKN4gsilDs7wQs6s8aOWKhNlIF-CrSABnD9moaZDyvWgbewW4DdCWlT7Kez8dtItj9YTweHZX5ZHInrMOJPrXnUwA5LYYu0wEfBWkKevTAz8hZl67U7JPlP1z1gyHtLPHB-6ZceUm4hCHQwJGT7ouLZ--SSU2VkxQPOgrAFfH7xF2N8PL-Vl0mBqLSbUFCBYPMZRXusEN5UBhDxfGxQjUKSSV8QgUMBMRbWxuShHeyklnPYfyQi8ONaNqmcfFNVa9Aa1X1xAcQsWPCEeWpeFhQlz6RsTzN-znCTW-_xAT4y_AE9CLN3kRlUJKzIg__K7zU"
 }
 ```
 Response:
 ```text
-400 Bad Request
+200 OK
 
 Cache-Control: private, no-store
 Pragma: no-cache
 Content-Type: application/json; charset=utf-8
-X-Request-Id: c65a9e92-41fa-491c-afcc-86fbbed86045
+Etag: W/"3a0625fee6f7d7d0d14a06de935e0eb9"
+X-Request-Id: 0ff6df6a-718b-439a-bfa3-76745e7cbc12
 Transfer-Encoding: chunked
 ```
 ```json
 {
-  "error": "invalid_request"
+  "access_token": "eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA4MzgwNjcsImlhdCI6MTU0MDgzNDQ2NywiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo1MDAwL21ldGFkYXRhIiwibmJmIjoxNTQwODM0NDY3LCJhdWQiOiJhMTE5OWQ3Zi05NGJkLTQ4YWMtYTUwMC04MzFiMzVkMzZkYjIiLCJqdGkiOiJkNjc2MGEwOS00NmJkLTQ4NDctYjY2MC1mOWM2OWUwZDJhMjYiLCJzdWIiOiJkYmVlYWMwMi0xN2Y0LTRlNDQtYTU2Yi03NmIwZGYyNjIxODYiLCJ0b2tlbl90eXBlIjoiYWNjZXNzIn0.od1NOh-sssOO_qvQ2nXrRvr-ZeumwEgNqh7SQth3gWV7kVGbjnS9xKvmzylwJtrJL8jp7AZXPpVzrYFTD-wsTK6oepA_mu08jCOfRLjFaSO2ryeAcETGHO2YOu_DZilHR7PxtnEMx8aZkrf9pnDox-AjhBwBibKEKq_TxG4vaijQxEYDqDqOFCUKHeG2FiLFRkM20Wz4_iO5X0E9Ph7xRu8qYglegYM9k_MrJYSAEjx9bcAENt4UULvkhPu_yWuTm7Zb7NPALT4vL75JF3NS1LDwQGijv3wRiqbg0Fp4qSy66sfvAgMa8CCLZoKagAq2eeZ6PDzf-9su6oi-_CiV9WJ7ZC8gV-AIR6GjlfnI43EbiHCzoxe6q2eF2XmXRxGvQpyhVPICF-wLTwaH9uCScyx7Tw6uYqsD-LFzPz6GlIV9phOq5LehWGykZUKesIyl6Y168EALz9GlQECetXqBMaLoPd2rDFShfe3DITYmCQ74ZUNBmBr-uQ1cTVT3xN05KNJDdQyT91itKdKxpVJESrHmCxYQnmdQAyrSPThdehe9mpLdw6cqwG7cMSE5JMzREhlGn9fE2HCudMIu0r7-Ja54FfPg7Gfedr2jpY1vsDlPM-W2IXtz-SIS1rZg6_aA_0OU7dQxEYejmHZF-uSzft7MP8bZO4BMBZatIH4SPAI",
+  "token_type": "Bearer",
+  "expires_in": 3600,
+  "refresh_token": "eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA5MjA4NjcsImlhdCI6MTU0MDgzNDQ2NywiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo1MDAwL21ldGFkYXRhIiwibmJmIjoxNTQwODM0NDY3LCJhdWQiOiJhMTE5OWQ3Zi05NGJkLTQ4YWMtYTUwMC04MzFiMzVkMzZkYjIiLCJqdGkiOiIxZGJjOTIzMS1hZTQ0LTQ2YjQtODJhZS00NWYwZWJjM2M0NDkiLCJzdWIiOiJkYmVlYWMwMi0xN2Y0LTRlNDQtYTU2Yi03NmIwZGYyNjIxODYiLCJ0b2tlbl90eXBlIjoicmVmcmVzaCJ9.R5F8RpPk1IuE9rjWSXKZw03Y_Brse0B-4RUZMa7d9j7A6sFQ6TfMKaDY7C2ff0_WD_L6AXQw0CAcQMgf2c8RrIvT2D-FXMnhF0TpL8u1SNKDvuFs6xpGztO_w_yk3imFm_6c5ryz7JpJk8BN2hGOT3Pfe1BHEHnWVbELfPGjRyRPO2xPoIs01n5kFB4W3pzBDcL-QIHXGMWL4iwzLiMUw_WHoSokq8dBhJZdty5DSIJMHY-hD738qSpmAuZt7g0eB81opkCY1vf8LNkH4FrYJPz3u8YEdkm7u64PSnnikFHrtf9nah6_jsovHdkbegBbpEwYXWIaM8dE8U9wCgwVmKQf4JGBtK0JCQGAYHMoifoPEfL5yBgMaF6FHqFlEKynu-uC2TRG-fDcg-bjaRUBuEJtyRvHyHbvUBrbpXbfzXHkHAUcipnPC9Dzgr-qZf_HgXhHBrARtU_S8oXL_AjJe32i7my4soRRRX10_3moCqY5CUK5FOx9XL1ULcdAJIMLsvAXz4NxuwTWTiOFSt3al-NRiQjNwrfbF0wnRhBArutvb5GUGkNODGX0_R0YRyrzBjqIuQ_mJ_7iMZ8RGAWYj8849llhkCgf3Ho7nz9u27yv52WErvWtOuYfxETF_bzToss7YEnTLPP0-J29B7G9vwJhGpMS99dB2NgL4bEOsFE"
 }
 ```
doc/_includes/oauth-tokens-saml-assertion.html
@@ -1,4 +1,134 @@
 
+#### POST http://localhost:5000/session/new
+
+Example curl request:
+
+```bash
+$ curl http://localhost:5000/session/new \
+  -X POST \
+  -d 'SAMLRequest=PHNhbWxwOkF1dGhuUmVxdWVzdCB4bWxuczpzYW1scD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOnByb3RvY29sIiB4bWxuczpzYW1sPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXNzZXJ0aW9uIiBJRD0iXzU3MjY2OTE3LWVjZmUtNDdmZi1iYzEwLTlhY2FjODhiMzMzOCIgVmVyc2lvbj0iMi4wIiBJc3N1ZUluc3RhbnQ9IjIwMTgtMTAtMjlUMTc6MzQ6MjZaIiBEZXN0aW5hdGlvbj0iIj48c2FtbDpJc3N1ZXI%2BaHR0cHM6Ly9zYW1sLWtpdC1haXJwb3J0Lmhlcm9rdWFwcC5jb20vc2VydmljZV9wcm92aWRlcnMvNzNkYjYzMzgtNWQzNS00MjcxLTgxMmMtZDRjNmZiZTQ1Y2NhPC9zYW1sOklzc3Vlcj48c2FtbHA6TmFtZUlEUG9saWN5IEZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOm5hbWVpZC1mb3JtYXQ6cGVyc2lzdGVudCIvPjwvc2FtbHA6QXV0aG5SZXF1ZXN0Pgo%3D' \
+  -H "Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3" \
+  -H "Accept: */*" \
+  -H "User-Agent: Ruby"
+```
+Request:
+```text
+Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+Accept: */*
+User-Agent: Ruby
+```
+```json
+
+```
+Response:
+```text
+200 OK
+
+X-Frame-Options: SAMEORIGIN
+X-Xss-Protection: 1; mode=block
+X-Content-Type-Options: nosniff
+X-Download-Options: noopen
+X-Permitted-Cross-Domain-Policies: none
+Referrer-Policy: strict-origin-when-cross-origin
+Content-Type: text/html; charset=utf-8
+Etag: W/"2a8c09bb7f5b0693995a84c37d603b34"
+Cache-Control: max-age=0, private, must-revalidate
+Set-Cookie: _proof=90e0736d21fe9db9c3324aa9da22ae25; path=/; HttpOnly
+X-Request-Id: c991677b-c40f-4897-8bdf-623fb3ef78b6
+Transfer-Encoding: chunked
+```
+```json
+
+```
+
+#### POST http://localhost:5000/session
+
+Example curl request:
+
+```bash
+$ curl http://localhost:5000/session \
+  -X POST \
+  -d 'SAMLRequest=PHNhbWxwOkF1dGhuUmVxdWVzdCB4bWxuczpzYW1scD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOnByb3RvY29sIiB4bWxuczpzYW1sPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXNzZXJ0aW9uIiBJRD0iXzU3MjY2OTE3LWVjZmUtNDdmZi1iYzEwLTlhY2FjODhiMzMzOCIgVmVyc2lvbj0iMi4wIiBJc3N1ZUluc3RhbnQ9IjIwMTgtMTAtMjlUMTc6MzQ6MjZaIiBEZXN0aW5hdGlvbj0iIj48c2FtbDpJc3N1ZXI%2BaHR0cHM6Ly9zYW1sLWtpdC1haXJwb3J0Lmhlcm9rdWFwcC5jb20vc2VydmljZV9wcm92aWRlcnMvNzNkYjYzMzgtNWQzNS00MjcxLTgxMmMtZDRjNmZiZTQ1Y2NhPC9zYW1sOklzc3Vlcj48c2FtbHA6TmFtZUlEUG9saWN5IEZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOm5hbWVpZC1mb3JtYXQ6cGVyc2lzdGVudCIvPjwvc2FtbHA6QXV0aG5SZXF1ZXN0Pgo%3D&authenticity_token=XVRwdSsaGIeBzH5PVuY8msDjyTW121pTyqcNccY5P525T0oL54AOlXC%2F45hRBRl2H%2BQ1qBGbYWprap4bTignkQ%3D%3D&user%5Bemail%5D=ester_simonis%40little.us&user%5Bpassword%5D=tBt3q2tykMu4AYp' \
+  -H "Cookie: _proof=90e0736d21fe9db9c3324aa9da22ae25" \
+  -H "Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3" \
+  -H "Accept: */*" \
+  -H "User-Agent: Ruby"
+```
+Request:
+```text
+Cookie: _proof=90e0736d21fe9db9c3324aa9da22ae25
+Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+Accept: */*
+User-Agent: Ruby
+```
+```json
+
+```
+Response:
+```text
+302 Found
+
+X-Frame-Options: SAMEORIGIN
+X-Xss-Protection: 1; mode=block
+X-Content-Type-Options: nosniff
+X-Download-Options: noopen
+X-Permitted-Cross-Domain-Policies: none
+Referrer-Policy: strict-origin-when-cross-origin
+Location: http://localhost:5000/response
+Content-Type: text/html; charset=utf-8
+Cache-Control: no-cache
+Set-Cookie: _proof=6b86c42fded94bee5fe2dfdb28a47847; path=/; HttpOnly
+X-Request-Id: 9c7d77a1-2061-40bc-890d-fcfc5f6f4447
+Transfer-Encoding: chunked
+```
+```json
+
+```
+
+#### GET http://localhost:5000/response
+
+Example curl request:
+
+```bash
+$ curl http://localhost:5000/response \
+  -X GET \
+  -d '' \
+  -H "Cookie: _proof=6b86c42fded94bee5fe2dfdb28a47847" \
+  -H "Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3" \
+  -H "Accept: */*" \
+  -H "User-Agent: Ruby"
+```
+Request:
+```text
+Cookie: _proof=6b86c42fded94bee5fe2dfdb28a47847
+Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+Accept: */*
+User-Agent: Ruby
+```
+```json
+
+```
+Response:
+```text
+200 OK
+
+X-Frame-Options: SAMEORIGIN
+X-Xss-Protection: 1; mode=block
+X-Content-Type-Options: nosniff
+X-Download-Options: noopen
+X-Permitted-Cross-Domain-Policies: none
+Referrer-Policy: strict-origin-when-cross-origin
+Content-Type: text/html; charset=utf-8
+Etag: W/"335c54596eb4a35e3826b370ef7d04ee"
+Cache-Control: max-age=0, private, must-revalidate
+Set-Cookie: _proof=919268c7a2bd989372559b4c3c6fd74f; path=/; HttpOnly
+X-Request-Id: 050e94c0-fbe3-46d0-8b47-b19404934405
+Transfer-Encoding: chunked
+```
+```json
+
+```
+
 #### POST http://localhost:5000/oauth/tokens
 
 Example curl request:
@@ -6,11 +136,11 @@ Example curl request:
 ```bash
 $ curl http://localhost:5000/oauth/tokens \
   -X POST \
-  -d '{"grant_type":"urn:ietf:params:oauth:grant-type:saml2-bearer","assertion":"PEFzc2VydGlvbiB4bWxucz0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFzc2VydGlvbiIgSUQ9Il85ODExZDUyMC02ZGUyLTQ5NTMtYjZmNC1iYTFlZjkyYWMxNmQiIElzc3VlSW5zdGFudD0iMjAxOC0xMC0yOVQwMTozMDo1MloiIFZlcnNpb249IjIuMCI-PElzc3Vlcj5odHRwOi8vcHJvb2YudGVzdDo1MDAwL21ldGFkYXRhPC9Jc3N1ZXI-PFNpZ25hdHVyZSB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC8wOS94bWxkc2lnIyI-PFNpZ25lZEluZm8-PENhbm9uaWNhbGl6YXRpb25NZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzEwL3htbC1leGMtYzE0biMiLz48U2lnbmF0dXJlTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxkc2lnLW1vcmUjcnNhLXNoYTI1NiIvPjxSZWZlcmVuY2UgVVJJPSIjXzk4MTFkNTIwLTZkZTItNDk1My1iNmY0LWJhMWVmOTJhYzE2ZCI-PFRyYW5zZm9ybXM-PFRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNlbnZlbG9wZWQtc2lnbmF0dXJlIi8-PFRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMTAveG1sLWV4Yy1jMTRuIyIvPjwvVHJhbnNmb3Jtcz48RGlnZXN0TWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxlbmMjc2hhMjU2Ii8-PERpZ2VzdFZhbHVlPkRSbVBrb2VOWDBLbElsMXA4ZTRzZzhkektOSG50WWorQmJrYmdFUzdrY2M9PC9EaWdlc3RWYWx1ZT48L1JlZmVyZW5jZT48L1NpZ25lZEluZm8-PFNpZ25hdHVyZVZhbHVlPm4zU1N2MzVkOHBlWkE3NzArN3pzL0ZoR0N1UHZyV2VFOEJEcEtqRFJXQ1ljY3dhSWRVUDQraTBGQWJmTzFJdVVIbmZGbVdCZEI3cHdKNjFES2dOcDZlYTd6VmlhL1YzRkRWc0lkTFk0Yi94Wkd1ZThJQ0JYc2hGR1lqd3JXamtHRmFOWHdmOENHdWo3bmpxem1jNzZVdGJHTVpqdGlPeVpsZUVKMFNUY3BNaEZ0VlA1eGVFVGlQakFZQ0lVT3hHRGRSWUFQZTlaeW5DRXRBTkU1WjNjLzJEdkJJY0tvci9sUUR5QUdicFQyRkoyM1RrN1NlOVBBTUFjNURuaWNnYTBKaElvZklTQTJVK1BFYUtBRE1UTENubGsweFM1ek5OOFdKUGlPWUwyMlJNWFd5RHFjWTVPNGI0Z25NZFgvTDlRQmg4eTdwUXAxQ2YzeVRETm9LZkRxZz09PC9TaWduYXR1cmVWYWx1ZT48S2V5SW5mbz48WDUwOURhdGE-PFg1MDlDZXJ0aWZpY2F0ZT5NSUlETnpDQ0FoK2dBd0lCQWdJQkFEQU5CZ2txaGtpRzl3MEJBUXNGQURCZk1Rc3dDUVlEVlFRR0V3SkRRVEVMTUFrR0ExVUVDQXdDUVVJeEVEQU9CZ05WQkFjTUIwTmhiR2RoY25reER6QU5CZ05WQkFvTUJsaHRiRXRwZERFUE1BMEdBMVVFQ3d3R1dHMXNTMmwwTVE4d0RRWURWUVFEREFaWWJXeExhWFF3SGhjTk1UZ3hNREk1TURFek1EVXhXaGNOTVRneE1USTRNREV6TURVeFdqQmZNUXN3Q1FZRFZRUUdFd0pEUVRFTE1Ba0dBMVVFQ0F3Q1FVSXhFREFPQmdOVkJBY01CME5oYkdkaGNua3hEekFOQmdOVkJBb01CbGh0YkV0cGRERVBNQTBHQTFVRUN3d0dXRzFzUzJsME1ROHdEUVlEVlFRRERBWlliV3hMYVhRd2dnRWlNQTBHQ1NxR1NJYjNEUUVCQVFVQUE0SUJEd0F3Z2dFS0FvSUJBUUREdVVadVBBTlV0OEdZYlA0TWVZZ0VJT3lydVhtUTVxYU80NVlwQ1lMUmcvZkt0ZzY5QlplZ0k5bXMrYlh2WGpTOHRDQzZRdVNyVWZwQ0xKNmN3aGs1ZGxsOG1FaFZJbXFRV1RwT2dMOWFsbDJNVzN3RC9HL0tFdjVNWUNMMndIc3N0SlFCWlgyTFYxTjFhcno2NitLVUFrV0V2dGpCTXpDV2V0SUNveGxiQ0ZBY2NoVDd6QUFBdHBDaGExSlc0Y1U2TGw2SVVFTjVYQWdWNTBpcFlGdEZRZ09OQ1VyMzlhL3p1WEVsRHZBbjJKRGdsaG1SYW9Mazh2TnBlT3ZHTGFVUWRIam5VUWRSNjl3RDFIWG5BSGJIbnVwUXY5WnpmeGlaZndBbmtNYnlqblA0amh2Wk9qcFdWQmM2dkw5dmRDYSs0Z2JMWHVqQ09laDVlSi9vcVQ0SEFnTUJBQUV3RFFZSktvWklodmNOQVFFTEJRQURnZ0VCQUUzbTBYaW16UXlRODlmYXZMN2dpVHB2dGJ1NTVWMDJldXdOSHFHb095cGJwV3JiNW5Zd3VPRGRlRkZIMEV1RHhCS3lTY2hYUlljRmhSbUQ1N1RHQmZ5T1BOa0xmUTY3R1NGVzM4UlRJdXhOcWxGNWc1OFNLWm83VlZxQnVCVGxlRGFBS2pyYUwvSWVvL29zdW1lNlNBZEo5MHdGcXVobU83QkVqenJXbnN0RERIS3o1RFU5RjRCZVJlRm9GUTlOVXhacUhLQ0V3aXRDcnFGaWNFUERtaW5xYk1XdllwRkx2MkcxNXdUa0U0ekFEMlV0U25Rdzc2eHpHTjZIZWR2QVU2NXdWMUFUWStQZ056eEpBc3BqSWRrckQyUXpleDdOVnFQTWZjWGJ0STR6d0ZubkZtQVlEUExyeCtjejY5T3o1eWw5NHdHN29nVTN0MnFmUEFkS3AzVT08L1g1MDlDZXJ0aWZpY2F0ZT48L1g1MDlEYXRhPjwvS2V5SW5mbz48L1NpZ25hdHVyZT48U3ViamVjdD48TmFtZUlEIEZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6MS4xOm5hbWVpZC1mb3JtYXQ6dW5zcGVjaWZpZWQiPm1lbHZpbmFAc3dhbmlhd3NraS5iaXo8L05hbWVJRD48U3ViamVjdENvbmZpcm1hdGlvbiBNZXRob2Q9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpjbTpiZWFyZXIiPjxTdWJqZWN0Q29uZmlybWF0aW9uRGF0YSBJblJlc3BvbnNlVG89Il80YzFmMmMzYS01NjViLTRkNWYtOTQzOC1iYjRlNWQwMGY4ZTciIE5vdE9uT3JBZnRlcj0iMjAxOC0xMC0yOVQwMTozNTo1MloiLz48L1N1YmplY3RDb25maXJtYXRpb24-PC9TdWJqZWN0PjxDb25kaXRpb25zIE5vdEJlZm9yZT0iMjAxOC0xMC0yOVQwMTozMDo1MloiIE5vdE9uT3JBZnRlcj0iMjAxOC0xMC0yOVQwNDozMDo1MloiPjxBdWRpZW5jZVJlc3RyaWN0aW9uPjxBdWRpZW5jZT5odHRwOi8vcHJvb2YudGVzdDo1MDAwL21ldGFkYXRhPC9BdWRpZW5jZT48L0F1ZGllbmNlUmVzdHJpY3Rpb24-PC9Db25kaXRpb25zPjxBdXRoblN0YXRlbWVudCBBdXRobkluc3RhbnQ9IjIwMTgtMTAtMjlUMDE6MzA6NTJaIiBTZXNzaW9uSW5kZXg9Il85ODExZDUyMC02ZGUyLTQ5NTMtYjZmNC1iYTFlZjkyYWMxNmQiPjxBdXRobkNvbnRleHQ-PEF1dGhuQ29udGV4dENsYXNzUmVmPnVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphYzpjbGFzc2VzOlBhc3N3b3JkPC9BdXRobkNvbnRleHRDbGFzc1JlZj48L0F1dGhuQ29udGV4dD48L0F1dGhuU3RhdGVtZW50PjxBdHRyaWJ1dGVTdGF0ZW1lbnQ-PEF0dHJpYnV0ZSBOYW1lPSJpZCI-PEF0dHJpYnV0ZVZhbHVlPmE1NDhiZDcwLWE4YzMtNGEyZi04YWU3LTU1MmU3ZjMyYjRkZDwvQXR0cmlidXRlVmFsdWU-PC9BdHRyaWJ1dGU-PEF0dHJpYnV0ZSBOYW1lPSJlbWFpbCI-PEF0dHJpYnV0ZVZhbHVlPm1lbHZpbmFAc3dhbmlhd3NraS5iaXo8L0F0dHJpYnV0ZVZhbHVlPjwvQXR0cmlidXRlPjxBdHRyaWJ1dGUgTmFtZT0iY3JlYXRlZF9hdCI-PEF0dHJpYnV0ZVZhbHVlPjIwMTgtMTAtMjkgMDE6MzA6NTIgVVRDPC9BdHRyaWJ1dGVWYWx1ZT48L0F0dHJpYnV0ZT48L0F0dHJpYnV0ZVN0YXRlbWVudD48L0Fzc2VydGlvbj4K"}' \
+  -d '{"grant_type":"urn:ietf:params:oauth:grant-type:saml2-bearer","assertion":"PEFzc2VydGlvbiB4bWxucz0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFzc2VydGlvbiIgSUQ9Il85OThlYTk4OC00NDgyLTQ3YWUtYTRhYi01ZGZiZmYyYjZkMzYiIElzc3VlSW5zdGFudD0iMjAxOC0xMC0yOVQxNzozNDoyNloiIFZlcnNpb249IjIuMCI-CiAgPElzc3Vlcj5odHRwOi8vbG9jYWxob3N0OjUwMDAvbWV0YWRhdGE8L0lzc3Vlcj4KICA8U2lnbmF0dXJlIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwLzA5L3htbGRzaWcjIj4KICAgIDxTaWduZWRJbmZvPgogICAgICA8Q2Fub25pY2FsaXphdGlvbk1ldGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMTAveG1sLWV4Yy1jMTRuIyIvPgogICAgICA8U2lnbmF0dXJlTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxkc2lnLW1vcmUjcnNhLXNoYTI1NiIvPgogICAgICA8UmVmZXJlbmNlIFVSST0iI185OThlYTk4OC00NDgyLTQ3YWUtYTRhYi01ZGZiZmYyYjZkMzYiPgogICAgICAgIDxUcmFuc2Zvcm1zPgogICAgICAgICAgPFRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNlbnZlbG9wZWQtc2lnbmF0dXJlIi8-CiAgICAgICAgICA8VHJhbnNmb3JtIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8xMC94bWwtZXhjLWMxNG4jIi8-CiAgICAgICAgPC9UcmFuc2Zvcm1zPgogICAgICAgIDxEaWdlc3RNZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzA0L3htbGVuYyNzaGEyNTYiLz4KICAgICAgICA8RGlnZXN0VmFsdWU-NXpmNzFqNkp0TEkxWjdYQWpDd0RRaXlobHpIOE85UWVNWVVRTzR3QkVrZz08L0RpZ2VzdFZhbHVlPgogICAgICA8L1JlZmVyZW5jZT4KICAgIDwvU2lnbmVkSW5mbz4KICAgIDxTaWduYXR1cmVWYWx1ZT5qWlZKWGNwRHFUcTJYQWp6MEc4YjYvK0xSTUt5a0dYUHNhdEdnR2tSWURtWjdOQkZrS3I0R1NVUGdjaytIZEQ1TldYdmVuNWFZZnNVQk9oWmhZbHptOVB2aS9LVzBxL1BodnU0Ujk5dUJUdWN6VjduUmxEYjBjbWZoMkR1WHBBeHJmbnp5SW50WEdLM0tRUmdZZFpJa2NkWHlKOXVjeG0vL21ITTgrS251RGF5di83SldtTmdKbXlZTFZjZFIza3lGdUpXWnZxM045WU04MUtrSGRlU0hsN2ZNOGNGek8zd3VHT2tYVGFCaUk3OVhtSTQ5WEJoVGZZT1F3NUdFZFpUSkVQUWs2bGpVV0ZsY0dWeEVUYWdJUVdncERTWHFOTDd0blBxanRXRUlxSis5d2RXVW1Bbm1PV3VFazNqT2dkWFZJT3dHazFnLzJJWVdNRHVvN0xrRXc9PTwvU2lnbmF0dXJlVmFsdWU-CiAgICA8S2V5SW5mbz4KICAgICAgPFg1MDlEYXRhPgogICAgICAgIDxYNTA5Q2VydGlmaWNhdGU-TUlJRE56Q0NBaCtnQXdJQkFnSUJBREFOQmdrcWhraUc5dzBCQVFzRkFEQmZNUXN3Q1FZRFZRUUdFd0pEUVRFTE1Ba0dBMVVFQ0F3Q1FVSXhFREFPQmdOVkJBY01CME5oYkdkaGNua3hEekFOQmdOVkJBb01CbGh0YkV0cGRERVBNQTBHQTFVRUN3d0dXRzFzUzJsME1ROHdEUVlEVlFRRERBWlliV3hMYVhRd0hoY05NVGd4TURJNU1UVXlNelExV2hjTk1UZ3hNVEk0TVRVeU16UTFXakJmTVFzd0NRWURWUVFHRXdKRFFURUxNQWtHQTFVRUNBd0NRVUl4RURBT0JnTlZCQWNNQjBOaGJHZGhjbmt4RHpBTkJnTlZCQW9NQmxodGJFdHBkREVQTUEwR0ExVUVDd3dHV0cxc1MybDBNUTh3RFFZRFZRUUREQVpZYld4TGFYUXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCRHdBd2dnRUtBb0lCQVFER29yVjAyZEdFakZ4YWYzMFVLNW1oVkNuSkZHWFUxeVg5UHFkWmtwdzF2QkpZR25WTkcxb3l6SnNndUxzSDE1UXpPa2lqU0cyUFUvNG9xK0U1RWdwamJieXd0bUVRWmdsUDMxZFNHcWw0SncrTFBsMjNlRkhFaHIvam4rM2tZQWRTRjhXRHNvaWZkUFFrL2JJRXY4b05tSW4zc0ovR0dtUHBwMmFqK0U3bTJ6K0pLTzRaU0VYRHBVT2FHM1YwUjhhU1A4UmdMdk5VZlZSalBEeUtSYTZIR2J0MXJDekVXOWIzUkEzN0UyWFVyZ3AwTkorNkU3dGRHelFwTWY4SnVXaXcwd3BBT2N2Mkp2ZlJ3WkRGbmQ3N080Q3MzcmhodkNlcnAxMC83K3hBNEhicTE1ckJEUFc1RXpmaE9LTTk5OHBDZ0JLUUhUSDA5aXFUNi9vNUNQdjdBZ01CQUFFd0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQkFHT0ZQTmw5dWNHN1loTXV0djRUYURlZVd1SnYyNUlXOXZXWkkrVy9Ic0VrSlg1K2lwakhCM2VabG5SQ3hydFpBK3B2cDdjZnlHdW5CK2htSVFEc201UklwVi84NTlHM0x0MWsvVzhvYmJGNFhlVjJvMmZYUTA3VkllTGdsWGF6ZzBKRmR4eHhsQ1lDdnA1bmRWT2xtdDNRbXFEdEVkcHNJVFpNa2tBK0l1dW1qcUx1c2toUTBHUCtTaUVldmxwdzVZQVlnNHUzcEtGV2RkY0xIRnVRY3BwY01hdVZyWDhlam83dm1vTEpxYWJyZjlNVlhSOWNwVTVkTnRTdHA1Wm5TSTBaMEJha1JrSnlITVcyQ0daZFBPQTg1L1Z5WHhYSGwxSXJkMy9tYTNBQTZSVXcrUHlicjR0cGhNbndCdUJhNk1ZKytSVzF0eUFEWkpEQ2pmZGxTRTg9PC9YNTA5Q2VydGlmaWNhdGU-CiAgICAgIDwvWDUwOURhdGE-CiAgICA8L0tleUluZm8-CiAgPC9TaWduYXR1cmU-CiAgPFN1YmplY3Q-CiAgICA8TmFtZUlEIEZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOm5hbWVpZC1mb3JtYXQ6cGVyc2lzdGVudCI-ODZhZjBhNmYtNjgxMi00YmUxLTljYjUtZDljMDNhM2MzMmUxPC9OYW1lSUQ-CiAgICA8U3ViamVjdENvbmZpcm1hdGlvbiBNZXRob2Q9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpjbTpiZWFyZXIiPgogICAgICA8U3ViamVjdENvbmZpcm1hdGlvbkRhdGEgSW5SZXNwb25zZVRvPSJfNTcyNjY5MTctZWNmZS00N2ZmLWJjMTAtOWFjYWM4OGIzMzM4IiBSZWNpcGllbnQ9Imh0dHBzOi8vc2FtbC1raXQtYWlycG9ydC5oZXJva3VhcHAuY29tL2Fzc2VydGlvbnMvY29uc3VtZSIgTm90T25PckFmdGVyPSIyMDE4LTEwLTI5VDE3OjM5OjI2WiIvPgogICAgPC9TdWJqZWN0Q29uZmlybWF0aW9uPgogIDwvU3ViamVjdD4KICA8Q29uZGl0aW9ucyBOb3RCZWZvcmU9IjIwMTgtMTAtMjlUMTc6MzQ6MjZaIiBOb3RPbk9yQWZ0ZXI9IjIwMTgtMTAtMjlUMjA6MzQ6MjZaIj4KICAgIDxBdWRpZW5jZVJlc3RyaWN0aW9uPgogICAgICA8QXVkaWVuY2U-aHR0cHM6Ly9zYW1sLWtpdC1haXJwb3J0Lmhlcm9rdWFwcC5jb20vc2VydmljZV9wcm92aWRlcnMvNzNkYjYzMzgtNWQzNS00MjcxLTgxMmMtZDRjNmZiZTQ1Y2NhPC9BdWRpZW5jZT4KICAgIDwvQXVkaWVuY2VSZXN0cmljdGlvbj4KICA8L0NvbmRpdGlvbnM-CiAgPEF1dGhuU3RhdGVtZW50IEF1dGhuSW5zdGFudD0iMjAxOC0xMC0yOVQxNzozNDoyNloiIFNlc3Npb25JbmRleD0iXzk5OGVhOTg4LTQ0ODItNDdhZS1hNGFiLTVkZmJmZjJiNmQzNiI-CiAgICA8QXV0aG5Db250ZXh0PgogICAgICA8QXV0aG5Db250ZXh0Q2xhc3NSZWY-dXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFjOmNsYXNzZXM6UGFzc3dvcmQ8L0F1dGhuQ29udGV4dENsYXNzUmVmPgogICAgPC9BdXRobkNvbnRleHQ-CiAgPC9BdXRoblN0YXRlbWVudD4KPC9Bc3NlcnRpb24-"}' \
   -H "Accept: application/json" \
   -H "Content-Type: application/json" \
   -H "User-Agent: net/hippie 0.1.9" \
-  -H "Authorization: Basic OTJkZTE4NmQtZjRmZC00N2E4LWFhNGEtZDliZmIwOGY3M2E0OkJlZms1SzRhaVhMd1Myek1BenBIMmZBYw==" \
+  -H "Authorization: Basic MzQ0YWEzOWUtNGJiYS00MzM4LWEyZTYtOTE4MjEzZmNhMjhlOnJjQUZBeUVVU2FuUHFzN2dkclJLdjIzQQ==" \
   -H "Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3"
 ```
 Request:
@@ -18,13 +148,13 @@ Request:
 Accept: application/json
 Content-Type: application/json
 User-Agent: net/hippie 0.1.9
-Authorization: Basic OTJkZTE4NmQtZjRmZC00N2E4LWFhNGEtZDliZmIwOGY3M2E0OkJlZms1SzRhaVhMd1Myek1BenBIMmZBYw==
+Authorization: Basic MzQ0YWEzOWUtNGJiYS00MzM4LWEyZTYtOTE4MjEzZmNhMjhlOnJjQUZBeUVVU2FuUHFzN2dkclJLdjIzQQ==
 Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3
 ```
 ```json
 {
   "grant_type": "urn:ietf:params:oauth:grant-type:saml2-bearer",
-  "assertion": "PEFzc2VydGlvbiB4bWxucz0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFzc2VydGlvbiIgSUQ9Il85ODExZDUyMC02ZGUyLTQ5NTMtYjZmNC1iYTFlZjkyYWMxNmQiIElzc3VlSW5zdGFudD0iMjAxOC0xMC0yOVQwMTozMDo1MloiIFZlcnNpb249IjIuMCI-PElzc3Vlcj5odHRwOi8vcHJvb2YudGVzdDo1MDAwL21ldGFkYXRhPC9Jc3N1ZXI-PFNpZ25hdHVyZSB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC8wOS94bWxkc2lnIyI-PFNpZ25lZEluZm8-PENhbm9uaWNhbGl6YXRpb25NZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzEwL3htbC1leGMtYzE0biMiLz48U2lnbmF0dXJlTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxkc2lnLW1vcmUjcnNhLXNoYTI1NiIvPjxSZWZlcmVuY2UgVVJJPSIjXzk4MTFkNTIwLTZkZTItNDk1My1iNmY0LWJhMWVmOTJhYzE2ZCI-PFRyYW5zZm9ybXM-PFRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNlbnZlbG9wZWQtc2lnbmF0dXJlIi8-PFRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMTAveG1sLWV4Yy1jMTRuIyIvPjwvVHJhbnNmb3Jtcz48RGlnZXN0TWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxlbmMjc2hhMjU2Ii8-PERpZ2VzdFZhbHVlPkRSbVBrb2VOWDBLbElsMXA4ZTRzZzhkektOSG50WWorQmJrYmdFUzdrY2M9PC9EaWdlc3RWYWx1ZT48L1JlZmVyZW5jZT48L1NpZ25lZEluZm8-PFNpZ25hdHVyZVZhbHVlPm4zU1N2MzVkOHBlWkE3NzArN3pzL0ZoR0N1UHZyV2VFOEJEcEtqRFJXQ1ljY3dhSWRVUDQraTBGQWJmTzFJdVVIbmZGbVdCZEI3cHdKNjFES2dOcDZlYTd6VmlhL1YzRkRWc0lkTFk0Yi94Wkd1ZThJQ0JYc2hGR1lqd3JXamtHRmFOWHdmOENHdWo3bmpxem1jNzZVdGJHTVpqdGlPeVpsZUVKMFNUY3BNaEZ0VlA1eGVFVGlQakFZQ0lVT3hHRGRSWUFQZTlaeW5DRXRBTkU1WjNjLzJEdkJJY0tvci9sUUR5QUdicFQyRkoyM1RrN1NlOVBBTUFjNURuaWNnYTBKaElvZklTQTJVK1BFYUtBRE1UTENubGsweFM1ek5OOFdKUGlPWUwyMlJNWFd5RHFjWTVPNGI0Z25NZFgvTDlRQmg4eTdwUXAxQ2YzeVRETm9LZkRxZz09PC9TaWduYXR1cmVWYWx1ZT48S2V5SW5mbz48WDUwOURhdGE-PFg1MDlDZXJ0aWZpY2F0ZT5NSUlETnpDQ0FoK2dBd0lCQWdJQkFEQU5CZ2txaGtpRzl3MEJBUXNGQURCZk1Rc3dDUVlEVlFRR0V3SkRRVEVMTUFrR0ExVUVDQXdDUVVJeEVEQU9CZ05WQkFjTUIwTmhiR2RoY25reER6QU5CZ05WQkFvTUJsaHRiRXRwZERFUE1BMEdBMVVFQ3d3R1dHMXNTMmwwTVE4d0RRWURWUVFEREFaWWJXeExhWFF3SGhjTk1UZ3hNREk1TURFek1EVXhXaGNOTVRneE1USTRNREV6TURVeFdqQmZNUXN3Q1FZRFZRUUdFd0pEUVRFTE1Ba0dBMVVFQ0F3Q1FVSXhFREFPQmdOVkJBY01CME5oYkdkaGNua3hEekFOQmdOVkJBb01CbGh0YkV0cGRERVBNQTBHQTFVRUN3d0dXRzFzUzJsME1ROHdEUVlEVlFRRERBWlliV3hMYVhRd2dnRWlNQTBHQ1NxR1NJYjNEUUVCQVFVQUE0SUJEd0F3Z2dFS0FvSUJBUUREdVVadVBBTlV0OEdZYlA0TWVZZ0VJT3lydVhtUTVxYU80NVlwQ1lMUmcvZkt0ZzY5QlplZ0k5bXMrYlh2WGpTOHRDQzZRdVNyVWZwQ0xKNmN3aGs1ZGxsOG1FaFZJbXFRV1RwT2dMOWFsbDJNVzN3RC9HL0tFdjVNWUNMMndIc3N0SlFCWlgyTFYxTjFhcno2NitLVUFrV0V2dGpCTXpDV2V0SUNveGxiQ0ZBY2NoVDd6QUFBdHBDaGExSlc0Y1U2TGw2SVVFTjVYQWdWNTBpcFlGdEZRZ09OQ1VyMzlhL3p1WEVsRHZBbjJKRGdsaG1SYW9Mazh2TnBlT3ZHTGFVUWRIam5VUWRSNjl3RDFIWG5BSGJIbnVwUXY5WnpmeGlaZndBbmtNYnlqblA0amh2Wk9qcFdWQmM2dkw5dmRDYSs0Z2JMWHVqQ09laDVlSi9vcVQ0SEFnTUJBQUV3RFFZSktvWklodmNOQVFFTEJRQURnZ0VCQUUzbTBYaW16UXlRODlmYXZMN2dpVHB2dGJ1NTVWMDJldXdOSHFHb095cGJwV3JiNW5Zd3VPRGRlRkZIMEV1RHhCS3lTY2hYUlljRmhSbUQ1N1RHQmZ5T1BOa0xmUTY3R1NGVzM4UlRJdXhOcWxGNWc1OFNLWm83VlZxQnVCVGxlRGFBS2pyYUwvSWVvL29zdW1lNlNBZEo5MHdGcXVobU83QkVqenJXbnN0RERIS3o1RFU5RjRCZVJlRm9GUTlOVXhacUhLQ0V3aXRDcnFGaWNFUERtaW5xYk1XdllwRkx2MkcxNXdUa0U0ekFEMlV0U25Rdzc2eHpHTjZIZWR2QVU2NXdWMUFUWStQZ056eEpBc3BqSWRrckQyUXpleDdOVnFQTWZjWGJ0STR6d0ZubkZtQVlEUExyeCtjejY5T3o1eWw5NHdHN29nVTN0MnFmUEFkS3AzVT08L1g1MDlDZXJ0aWZpY2F0ZT48L1g1MDlEYXRhPjwvS2V5SW5mbz48L1NpZ25hdHVyZT48U3ViamVjdD48TmFtZUlEIEZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6MS4xOm5hbWVpZC1mb3JtYXQ6dW5zcGVjaWZpZWQiPm1lbHZpbmFAc3dhbmlhd3NraS5iaXo8L05hbWVJRD48U3ViamVjdENvbmZpcm1hdGlvbiBNZXRob2Q9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpjbTpiZWFyZXIiPjxTdWJqZWN0Q29uZmlybWF0aW9uRGF0YSBJblJlc3BvbnNlVG89Il80YzFmMmMzYS01NjViLTRkNWYtOTQzOC1iYjRlNWQwMGY4ZTciIE5vdE9uT3JBZnRlcj0iMjAxOC0xMC0yOVQwMTozNTo1MloiLz48L1N1YmplY3RDb25maXJtYXRpb24-PC9TdWJqZWN0PjxDb25kaXRpb25zIE5vdEJlZm9yZT0iMjAxOC0xMC0yOVQwMTozMDo1MloiIE5vdE9uT3JBZnRlcj0iMjAxOC0xMC0yOVQwNDozMDo1MloiPjxBdWRpZW5jZVJlc3RyaWN0aW9uPjxBdWRpZW5jZT5odHRwOi8vcHJvb2YudGVzdDo1MDAwL21ldGFkYXRhPC9BdWRpZW5jZT48L0F1ZGllbmNlUmVzdHJpY3Rpb24-PC9Db25kaXRpb25zPjxBdXRoblN0YXRlbWVudCBBdXRobkluc3RhbnQ9IjIwMTgtMTAtMjlUMDE6MzA6NTJaIiBTZXNzaW9uSW5kZXg9Il85ODExZDUyMC02ZGUyLTQ5NTMtYjZmNC1iYTFlZjkyYWMxNmQiPjxBdXRobkNvbnRleHQ-PEF1dGhuQ29udGV4dENsYXNzUmVmPnVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphYzpjbGFzc2VzOlBhc3N3b3JkPC9BdXRobkNvbnRleHRDbGFzc1JlZj48L0F1dGhuQ29udGV4dD48L0F1dGhuU3RhdGVtZW50PjxBdHRyaWJ1dGVTdGF0ZW1lbnQ-PEF0dHJpYnV0ZSBOYW1lPSJpZCI-PEF0dHJpYnV0ZVZhbHVlPmE1NDhiZDcwLWE4YzMtNGEyZi04YWU3LTU1MmU3ZjMyYjRkZDwvQXR0cmlidXRlVmFsdWU-PC9BdHRyaWJ1dGU-PEF0dHJpYnV0ZSBOYW1lPSJlbWFpbCI-PEF0dHJpYnV0ZVZhbHVlPm1lbHZpbmFAc3dhbmlhd3NraS5iaXo8L0F0dHJpYnV0ZVZhbHVlPjwvQXR0cmlidXRlPjxBdHRyaWJ1dGUgTmFtZT0iY3JlYXRlZF9hdCI-PEF0dHJpYnV0ZVZhbHVlPjIwMTgtMTAtMjkgMDE6MzA6NTIgVVRDPC9BdHRyaWJ1dGVWYWx1ZT48L0F0dHJpYnV0ZT48L0F0dHJpYnV0ZVN0YXRlbWVudD48L0Fzc2VydGlvbj4K"
+  "assertion": "PEFzc2VydGlvbiB4bWxucz0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFzc2VydGlvbiIgSUQ9Il85OThlYTk4OC00NDgyLTQ3YWUtYTRhYi01ZGZiZmYyYjZkMzYiIElzc3VlSW5zdGFudD0iMjAxOC0xMC0yOVQxNzozNDoyNloiIFZlcnNpb249IjIuMCI-CiAgPElzc3Vlcj5odHRwOi8vbG9jYWxob3N0OjUwMDAvbWV0YWRhdGE8L0lzc3Vlcj4KICA8U2lnbmF0dXJlIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwLzA5L3htbGRzaWcjIj4KICAgIDxTaWduZWRJbmZvPgogICAgICA8Q2Fub25pY2FsaXphdGlvbk1ldGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMTAveG1sLWV4Yy1jMTRuIyIvPgogICAgICA8U2lnbmF0dXJlTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxkc2lnLW1vcmUjcnNhLXNoYTI1NiIvPgogICAgICA8UmVmZXJlbmNlIFVSST0iI185OThlYTk4OC00NDgyLTQ3YWUtYTRhYi01ZGZiZmYyYjZkMzYiPgogICAgICAgIDxUcmFuc2Zvcm1zPgogICAgICAgICAgPFRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNlbnZlbG9wZWQtc2lnbmF0dXJlIi8-CiAgICAgICAgICA8VHJhbnNmb3JtIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8xMC94bWwtZXhjLWMxNG4jIi8-CiAgICAgICAgPC9UcmFuc2Zvcm1zPgogICAgICAgIDxEaWdlc3RNZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzA0L3htbGVuYyNzaGEyNTYiLz4KICAgICAgICA8RGlnZXN0VmFsdWU-NXpmNzFqNkp0TEkxWjdYQWpDd0RRaXlobHpIOE85UWVNWVVRTzR3QkVrZz08L0RpZ2VzdFZhbHVlPgogICAgICA8L1JlZmVyZW5jZT4KICAgIDwvU2lnbmVkSW5mbz4KICAgIDxTaWduYXR1cmVWYWx1ZT5qWlZKWGNwRHFUcTJYQWp6MEc4YjYvK0xSTUt5a0dYUHNhdEdnR2tSWURtWjdOQkZrS3I0R1NVUGdjaytIZEQ1TldYdmVuNWFZZnNVQk9oWmhZbHptOVB2aS9LVzBxL1BodnU0Ujk5dUJUdWN6VjduUmxEYjBjbWZoMkR1WHBBeHJmbnp5SW50WEdLM0tRUmdZZFpJa2NkWHlKOXVjeG0vL21ITTgrS251RGF5di83SldtTmdKbXlZTFZjZFIza3lGdUpXWnZxM045WU04MUtrSGRlU0hsN2ZNOGNGek8zd3VHT2tYVGFCaUk3OVhtSTQ5WEJoVGZZT1F3NUdFZFpUSkVQUWs2bGpVV0ZsY0dWeEVUYWdJUVdncERTWHFOTDd0blBxanRXRUlxSis5d2RXVW1Bbm1PV3VFazNqT2dkWFZJT3dHazFnLzJJWVdNRHVvN0xrRXc9PTwvU2lnbmF0dXJlVmFsdWU-CiAgICA8S2V5SW5mbz4KICAgICAgPFg1MDlEYXRhPgogICAgICAgIDxYNTA5Q2VydGlmaWNhdGU-TUlJRE56Q0NBaCtnQXdJQkFnSUJBREFOQmdrcWhraUc5dzBCQVFzRkFEQmZNUXN3Q1FZRFZRUUdFd0pEUVRFTE1Ba0dBMVVFQ0F3Q1FVSXhFREFPQmdOVkJBY01CME5oYkdkaGNua3hEekFOQmdOVkJBb01CbGh0YkV0cGRERVBNQTBHQTFVRUN3d0dXRzFzUzJsME1ROHdEUVlEVlFRRERBWlliV3hMYVhRd0hoY05NVGd4TURJNU1UVXlNelExV2hjTk1UZ3hNVEk0TVRVeU16UTFXakJmTVFzd0NRWURWUVFHRXdKRFFURUxNQWtHQTFVRUNBd0NRVUl4RURBT0JnTlZCQWNNQjBOaGJHZGhjbmt4RHpBTkJnTlZCQW9NQmxodGJFdHBkREVQTUEwR0ExVUVDd3dHV0cxc1MybDBNUTh3RFFZRFZRUUREQVpZYld4TGFYUXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCRHdBd2dnRUtBb0lCQVFER29yVjAyZEdFakZ4YWYzMFVLNW1oVkNuSkZHWFUxeVg5UHFkWmtwdzF2QkpZR25WTkcxb3l6SnNndUxzSDE1UXpPa2lqU0cyUFUvNG9xK0U1RWdwamJieXd0bUVRWmdsUDMxZFNHcWw0SncrTFBsMjNlRkhFaHIvam4rM2tZQWRTRjhXRHNvaWZkUFFrL2JJRXY4b05tSW4zc0ovR0dtUHBwMmFqK0U3bTJ6K0pLTzRaU0VYRHBVT2FHM1YwUjhhU1A4UmdMdk5VZlZSalBEeUtSYTZIR2J0MXJDekVXOWIzUkEzN0UyWFVyZ3AwTkorNkU3dGRHelFwTWY4SnVXaXcwd3BBT2N2Mkp2ZlJ3WkRGbmQ3N080Q3MzcmhodkNlcnAxMC83K3hBNEhicTE1ckJEUFc1RXpmaE9LTTk5OHBDZ0JLUUhUSDA5aXFUNi9vNUNQdjdBZ01CQUFFd0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQkFHT0ZQTmw5dWNHN1loTXV0djRUYURlZVd1SnYyNUlXOXZXWkkrVy9Ic0VrSlg1K2lwakhCM2VabG5SQ3hydFpBK3B2cDdjZnlHdW5CK2htSVFEc201UklwVi84NTlHM0x0MWsvVzhvYmJGNFhlVjJvMmZYUTA3VkllTGdsWGF6ZzBKRmR4eHhsQ1lDdnA1bmRWT2xtdDNRbXFEdEVkcHNJVFpNa2tBK0l1dW1qcUx1c2toUTBHUCtTaUVldmxwdzVZQVlnNHUzcEtGV2RkY0xIRnVRY3BwY01hdVZyWDhlam83dm1vTEpxYWJyZjlNVlhSOWNwVTVkTnRTdHA1Wm5TSTBaMEJha1JrSnlITVcyQ0daZFBPQTg1L1Z5WHhYSGwxSXJkMy9tYTNBQTZSVXcrUHlicjR0cGhNbndCdUJhNk1ZKytSVzF0eUFEWkpEQ2pmZGxTRTg9PC9YNTA5Q2VydGlmaWNhdGU-CiAgICAgIDwvWDUwOURhdGE-CiAgICA8L0tleUluZm8-CiAgPC9TaWduYXR1cmU-CiAgPFN1YmplY3Q-CiAgICA8TmFtZUlEIEZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOm5hbWVpZC1mb3JtYXQ6cGVyc2lzdGVudCI-ODZhZjBhNmYtNjgxMi00YmUxLTljYjUtZDljMDNhM2MzMmUxPC9OYW1lSUQ-CiAgICA8U3ViamVjdENvbmZpcm1hdGlvbiBNZXRob2Q9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpjbTpiZWFyZXIiPgogICAgICA8U3ViamVjdENvbmZpcm1hdGlvbkRhdGEgSW5SZXNwb25zZVRvPSJfNTcyNjY5MTctZWNmZS00N2ZmLWJjMTAtOWFjYWM4OGIzMzM4IiBSZWNpcGllbnQ9Imh0dHBzOi8vc2FtbC1raXQtYWlycG9ydC5oZXJva3VhcHAuY29tL2Fzc2VydGlvbnMvY29uc3VtZSIgTm90T25PckFmdGVyPSIyMDE4LTEwLTI5VDE3OjM5OjI2WiIvPgogICAgPC9TdWJqZWN0Q29uZmlybWF0aW9uPgogIDwvU3ViamVjdD4KICA8Q29uZGl0aW9ucyBOb3RCZWZvcmU9IjIwMTgtMTAtMjlUMTc6MzQ6MjZaIiBOb3RPbk9yQWZ0ZXI9IjIwMTgtMTAtMjlUMjA6MzQ6MjZaIj4KICAgIDxBdWRpZW5jZVJlc3RyaWN0aW9uPgogICAgICA8QXVkaWVuY2U-aHR0cHM6Ly9zYW1sLWtpdC1haXJwb3J0Lmhlcm9rdWFwcC5jb20vc2VydmljZV9wcm92aWRlcnMvNzNkYjYzMzgtNWQzNS00MjcxLTgxMmMtZDRjNmZiZTQ1Y2NhPC9BdWRpZW5jZT4KICAgIDwvQXVkaWVuY2VSZXN0cmljdGlvbj4KICA8L0NvbmRpdGlvbnM-CiAgPEF1dGhuU3RhdGVtZW50IEF1dGhuSW5zdGFudD0iMjAxOC0xMC0yOVQxNzozNDoyNloiIFNlc3Npb25JbmRleD0iXzk5OGVhOTg4LTQ0ODItNDdhZS1hNGFiLTVkZmJmZjJiNmQzNiI-CiAgICA8QXV0aG5Db250ZXh0PgogICAgICA8QXV0aG5Db250ZXh0Q2xhc3NSZWY-dXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFjOmNsYXNzZXM6UGFzc3dvcmQ8L0F1dGhuQ29udGV4dENsYXNzUmVmPgogICAgPC9BdXRobkNvbnRleHQ-CiAgPC9BdXRoblN0YXRlbWVudD4KPC9Bc3NlcnRpb24-"
 }
 ```
 Response:
@@ -34,7 +164,7 @@ Response:
 Cache-Control: private, no-store
 Pragma: no-cache
 Content-Type: application/json; charset=utf-8
-X-Request-Id: d603c356-fa02-421a-bd5b-8502d9504897
+X-Request-Id: 373db830-3156-46f5-a506-43f913f7675a
 Transfer-Encoding: chunked
 ```
 ```json
doc/_includes/scim-resource-type-group.html
@@ -29,7 +29,7 @@ Response:
 Content-Type: application/scim+json
 Etag: W/"d0dea12284b4b8c065c626de41ae8b7c"
 Cache-Control: max-age=0, private, must-revalidate
-X-Request-Id: 0638d0b4-9be7-4178-9090-c514ebee373f
+X-Request-Id: 2916c0bf-1610-4e21-ae41-468b8bb8f9a4
 Transfer-Encoding: chunked
 ```
 ```json
doc/_includes/scim-resource-type-user.html
@@ -29,7 +29,7 @@ Response:
 Content-Type: application/scim+json
 Etag: W/"de7bd5d9f401078c697e3c7412e52207"
 Cache-Control: max-age=0, private, must-revalidate
-X-Request-Id: bd85e44a-7b33-45a6-a1fd-c245ccf8cb50
+X-Request-Id: 102b1a8a-92a0-4d93-9374-4fe2cea9bcb9
 Transfer-Encoding: chunked
 ```
 ```json
doc/_includes/scim-resource-types.html
@@ -29,7 +29,7 @@ Response:
 Content-Type: application/scim+json
 Etag: W/"56f19f58fa40ed54afeee2b454e0789d"
 Cache-Control: max-age=0, private, must-revalidate
-X-Request-Id: f415161c-58a4-4852-9bab-778851c72f0d
+X-Request-Id: 06329ff1-216e-4c33-93f9-46d006e16bd7
 Transfer-Encoding: chunked
 ```
 ```json
doc/_includes/scim-schemas-groups.html
@@ -29,7 +29,7 @@ Response:
 Content-Type: application/scim+json
 Etag: W/"20238e8dae84ccca47f9554b77002d2b"
 Cache-Control: max-age=0, private, must-revalidate
-X-Request-Id: e982c061-0e4f-4c81-8cbb-baebf394c79f
+X-Request-Id: 53f8ea94-6008-4a43-9b24-dab3743db99d
 Transfer-Encoding: chunked
 ```
 ```json
doc/_includes/scim-schemas-users.html
@@ -29,7 +29,7 @@ Response:
 Content-Type: application/scim+json
 Etag: W/"224ff8cd051e6e139df9048f0ffeb953"
 Cache-Control: max-age=0, private, must-revalidate
-X-Request-Id: 29eb018f-85a3-4adb-947d-31ef716e1943
+X-Request-Id: 6cb0c4e7-d6ad-4cbe-b526-7e71cc862927
 Transfer-Encoding: chunked
 ```
 ```json
doc/_includes/scim-schemas.html
@@ -29,7 +29,7 @@ Response:
 Content-Type: application/scim+json
 Etag: W/"c1a9d3beaf604b0b14d9df02a1b0e8ce"
 Cache-Control: max-age=0, private, must-revalidate
-X-Request-Id: 44c250c3-f37b-48c9-a100-4178695bdf8f
+X-Request-Id: 4f1d2c71-8d46-4e09-83b9-105d77b698e0
 Transfer-Encoding: chunked
 ```
 ```json
doc/_includes/scim-service-provider-config.html
@@ -27,9 +27,9 @@ Response:
 200 OK
 
 Content-Type: application/scim+json
-Etag: W/"3f8a8e539ffd52c026e46a8671fddb4c"
+Etag: W/"9dca6148d7e4fc9b26b5997355d0d962"
 Cache-Control: max-age=0, private, must-revalidate
-X-Request-Id: 4821d331-b70e-4bee-a415-8e65f0f4a712
+X-Request-Id: c718be94-7780-4e6c-b0ea-c189152cac61
 Transfer-Encoding: chunked
 ```
 ```json
@@ -71,8 +71,8 @@ Transfer-Encoding: chunked
   ],
   "meta": {
     "resourceType": "ServiceProviderConfig",
-    "created": "2018-10-29T01:30:54Z",
-    "lastModified": "2018-10-29T01:30:54Z",
+    "created": "2018-10-29T17:34:27Z",
+    "lastModified": "2018-10-29T17:34:27Z",
     "location": "http://localhost:5000/scim/v2/ServiceProviderConfig",
     "version": 1
   }
spec/documentation.rb
@@ -9,18 +9,17 @@ require 'factory_bot_rails'
 RSpec.configure do |config|
   config.include FactoryBot::Syntax::Methods
   config.before :suite do
-    FileUtils.rm_rf(Rails.root.join('doc/_cassettes/'))
+    FileUtils.rm_rf(Rails.root.join('tmp/_cassettes/'))
     Net::Hippie.logger = Logger.new('/dev/null')
     VCR.configure do |x|
-      x.cassette_library_dir = "doc/_cassettes"
+      x.cassette_library_dir = "tmp/_cassettes"
       x.hook_into :webmock
     end
   end
 
   config.after :suite do
-    template = IO.read('doc/_includes/curl.erb')
-    erb = ERB.new(template)
-    Dir["doc/_cassettes/**/*.yml"].each do |cassette|
+    erb = ERB.new(IO.read('doc/_includes/curl.erb'))
+    Dir["tmp/_cassettes/**/*.yml"].each do |cassette|
       @configuration = YAML.safe_load(IO.read(cassette))
       result = erb.result(binding)
       IO.write("doc/_includes/#{File.basename(cassette).parameterize.gsub(/-yml/, '')}.html", result)
@@ -28,12 +27,47 @@ RSpec.configure do |config|
   end
 end
 
+class UserAgent
+  def login_with(scheme: 'https', host:, email:, password:, issuer:)
+    authn_request = Saml::Kit::AuthenticationRequest.build(configuration: Saml::Kit.configuration) do |x|
+      x.issuer = issuer
+      x.embed_signature = false
+    end
+    body = { SAMLRequest: Base64.strict_encode64(authn_request.to_xml) }
+    response = client.post("#{scheme}://#{host}/session/new", body: URI.encode_www_form(body))
+    form = Nokogiri::HTML(response.body).css('form').last
+    body.merge!(
+      'authenticity_token' => form.css('[name=authenticity_token]').first.attribute('value').value,
+      'user[email]' => email,
+      'user[password]' => password
+    )
+    session_cookie = parse_cookie(response['Set-Cookie'])
+    response = client.post("#{scheme}://#{host}/session", headers: { 'Cookie' => session_cookie }, body: URI.encode_www_form(body))
+
+    session_cookie = parse_cookie(response['Set-Cookie'])
+    response = client.get(response['Location'], headers: { 'Cookie' => session_cookie })
+    encoded_saml_response = Nokogiri::HTML(response.body).css('#SAMLResponse').attribute('value').value
+    Saml::Kit::Bindings::HttpPost.new(location: '').deserialize(SAMLResponse: encoded_saml_response)
+  end
+
+  private
+
+  def client
+    @client ||= Net::Hippie::Client.new(verify_mode: OpenSSL::SSL::VERIFY_NONE, headers: {})
+  end
+
+  def parse_cookie(value)
+    value.split(';')[0]
+  end
+end
+
 RSpec.describe "documentation" do
   let(:hippie) { Net::Hippie::Client.new(verify_mode: OpenSSL::SSL::VERIFY_NONE) }
   let(:host) { ENV.fetch('HOST', 'proof.test') }
   let(:scheme) { ENV.fetch('SCHEME', 'https') }
   let(:client) { create(:client) }
   let(:user) { create(:user) }
+  let(:user_agent) { UserAgent.new }
 
   specify do
     VCR.use_cassette("get-well-known-oauth-authorization-server") do
@@ -71,11 +105,10 @@ RSpec.describe "documentation" do
   end
 
   specify do
-    headers = { 'Authorization' => ActionController::HttpAuthentication::Basic.encode_credentials(client.to_param, client.password) }
-    saml_request = instance_double(Saml::Kit::AuthenticationRequest, id: Xml::Kit::Id.generate, issuer: Saml::Kit.configuration.entity_id, trusted?: true)
-    saml = Saml::Kit::Assertion.build_xml(user, saml_request)
-    body = { grant_type: 'urn:ietf:params:oauth:grant-type:saml2-bearer', assertion: Base64.urlsafe_encode64(saml) }
     VCR.use_cassette("oauth-tokens-saml-assertion") do
+      saml = user_agent.login_with(scheme: scheme, host: host, email: user.email, password: user.password, issuer: 'https://saml-kit-airport.herokuapp.com/service_providers/73db6338-5d35-4271-812c-d4c6fbe45cca')
+      headers = { 'Authorization' => ActionController::HttpAuthentication::Basic.encode_credentials(client.to_param, client.password) }
+      body = { grant_type: 'urn:ietf:params:oauth:grant-type:saml2-bearer', assertion: Base64.urlsafe_encode64(saml.assertion.to_xml) }
       response = hippie.post("#{scheme}://#{host}/oauth/tokens", body: body, headers: headers)
       expect(response.code).to eql('200')
     end
.env
@@ -1,2 +1,1 @@
-ISSUER=http://proof.test/metadata
 RAILS_MASTER_KEY=''
.gitignore
@@ -41,4 +41,3 @@ pkg
 BUILD
 .sass-cache
 public/doc
-doc/_cassettes/