[JIRA] Updated: (SSPCPP-448) setting relayState to use ODBC storage service results in attempted redirects to an invalid URL

[Scott Cantor (JIRA)]

     [ https://issues.shibboleth.net/jira/browse/SSPCPP-448?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Scott Cantor updated SSPCPP-448:
--------------------------------

     Affects Version/s: 2.4
                        2.4.1
                        2.4.2
         Fix Version/s: 2.5
    Remaining Estimate: 20 minutes
     Original Estimate: 20 minutes

The ODBC plugin isn't clearing the return parameter before appending the driver result, so the original RelayState string is left in the buffer.

> setting relayState to use ODBC storage service results in attempted redirects to an invalid URL
> -----------------------------------------------------------------------------------------------
>
>                 Key: SSPCPP-448
>                 URL: https://issues.shibboleth.net/jira/browse/SSPCPP-448
>             Project: Shibboleth SP - C++
>          Issue Type: Bug
>      Security Level: Standard(Standard bug, may impact functionality but does not represent a security vulnerability ) 
>          Components: SAML 2.0 Single Sign-On
>    Affects Versions: 2.4, 2.4.1, 2.4.2, 2.4.3
>         Environment: RHEL5 and 6, Apache 2.2, SP 2.4.3 from RPM, and MySQL for storage service. 
>            Reporter: Sebastien Otto Korner
>            Assignee: Scott Cantor
>            Priority: Minor
>              Labels: Session
>             Fix For: 2.5
>
>   Original Estimate: 20 minutes
>  Remaining Estimate: 20 minutes
>
> When using the ODBC storage service and setting the Session attribute relayState to use this storage service (ss:db), the redirect generated at the end of SSO is to a URL value that appears to include the internal identification info instead of just the URL.  In the logs one sees:
> ACS returning via redirect to: ss:db:dd9523710a79a9e408efa5fde5c4e447https://test.babel.hathitrust.org/shcgi/mb
> This leads to an XMLTooling error in the browser and similar message in the native log:
> ERROR Shibboleth.Apache [16332] shib_handler: URL contains invalid scheme (ss).
> Thanks.
> Sebastien

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira