[JIRA] Created: (EDS-35) EDS fails if native XMLHttp will be disabled in IE

[dantech@idp.protectnetwork.org (JIRA)]

EDS fails if native XMLHttp will be disabled in IE 
---------------------------------------------------

                 Key: EDS-35
                 URL: https://issues.shibboleth.net/jira/browse/EDS-35
             Project: Embedded Discovery Service
          Issue Type: Bug
    Affects Versions: 1.0.1
         Environment: Internet Explorer with "Enable native XMLHTTP support" disabled.
            Reporter: dantech at idp.protectnetwork.org
            Assignee: Rod Widdowson
         Attachments: idpselect.js.patch

If "Enable native XMLHTTP support" is disabled in IE, then users won't be able to use the EDS, but instead will be presented with the error message "FATAL - DISCO UI:Browser does not support XMLHttpRequest, unable to load IdP selection data" or "Browser does not support XMLHttpRequest, unable to load IdP selection data"

Microsoft recommends a solution to the problem in the following link: 
http://msdn.microsoft.com/en-us/library/ie/ms537505(v=vs.85).aspx

If native XMLHTTP has been disabled, developers can override the XMLHttpRequest property of the window object with the MSXML-XMLHTTP control, unless ActiveX has also been disabled, as in the following example.

if (!window.XMLHttpRequest) {
    window.XMLHttpRequest = function() {
        try {
            return new ActiveXObject('MSXML2.XMLHTTP.3.0');
        }
        catch (ex) {
            return null;
        }
    }
} 


The Embedded Discovery Service code that is causing the issue can be found in the idpselect.js.

Here is the function where the problem occurs...

    /**
       Loads the data used by the IdP selection UI.  Data is loaded 
       from a JSON document fetched from the given url.
      
       @param {Function} failureCallback A function called if the JSON
       document can not be loaded from the source.  This function will
       passed the {@link XMLHttpRequest} used to request the JSON data.
    */
    var load = function(dataSource){
        var xhr = null;

        try {
            xhr = new XMLHttpRequest();    <--- Exception is thrown here.
        } catch (e) {}
        if (null == xhr) {
            fatal(getLocalizedMessage('fatal.noXMLHttpRequest'));
            return false;
        }

        if (isIE()) {
            //
            // cache bust (for IE)
            //
            dataSource += '?random=' + (Math.random()*1000000);
        }

        //
        // Grab the data
        //
        xhr.open('GET', dataSource, false);
        if (typeof xhr.overrideMimeType == 'function') {
            xhr.overrideMimeType('application/json');
        }
        xhr.send(null);
        
        if(xhr.status == 200){
            //
            // 200 means we got it OK from as web source
            // if locally loading its 0.  Go figure
            //
            var jsonData = xhr.responseText;
            if(jsonData === null){
                fatal(getLocalizedMessage('fatal.noData'));
                return false;
            }

            //
            // Parse it
            //

            idpData = JSON.parse(jsonData);

        }else{
            fatal(getLocalizedMessage('fatal.loadFailed') + dataSource);
            return false;
        }
        return true;
    };


I've attached a patch that we are using to get around the problem.



--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira