[JIRA] (IDP-2135) IdP metadata endpoint incorrect http content-type

[Holger Wurbs (Jira)]

Holger Wurbs ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=712020%3A90c50fcc-585a-4237-b2b7-3420d7be68f3 ) *created* an issue

Identity Provider ( https://shibboleth.atlassian.net/browse/IDP?atlOrigin=eyJpIjoiZTdjODc2OTMyMzU4NDY4Mjk5MTc0ODlmYjgxODU1NjMiLCJwIjoiaiJ9 ) / Bug ( https://shibboleth.atlassian.net/browse/IDP-2135?atlOrigin=eyJpIjoiZTdjODc2OTMyMzU4NDY4Mjk5MTc0ODlmYjgxODU1NjMiLCJwIjoiaiJ9 ) IDP-2135 ( https://shibboleth.atlassian.net/browse/IDP-2135?atlOrigin=eyJpIjoiZTdjODc2OTMyMzU4NDY4Mjk5MTc0ODlmYjgxODU1NjMiLCJwIjoiaiJ9 ) IdP metadata endpoint incorrect http content-type ( https://shibboleth.atlassian.net/browse/IDP-2135?atlOrigin=eyJpIjoiZTdjODc2OTMyMzU4NDY4Mjk5MTc0ODlmYjgxODU1NjMiLCJwIjoiaiJ9 )

Issue Type: Bug Affects Versions: 4.3.1 Assignee: Brent Putman ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A97de0981-adc3-4044-95ed-131622fad81e ) Components: Metadata Created: 28/Jun/23 12:22 PM Priority: Low Reporter: Holger Wurbs ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=712020%3A90c50fcc-585a-4237-b2b7-3420d7be68f3 )

The metadata endpoint /idp/shibboleth, which by default streams the unfiltered content of /metadata/idp-metadata.xml , emits the HTTP Header

Content-Type: text/html;charset=UTF-8

instead of

Content-Type: application/xml
(or application/samlmetadata+xml if accepted by the client)

I am not sure if this issue is related to the app server that I am using (tomcat 9) and also appears only to be the case with newer IdP versions (tested on 4.3.1) but I can verify this bug for quite a lot of production IdP installations. Since the endpoint is basically just a JSP page …/WEB-INF/jsp/metadata.jsp I tried editing the page by copying it to edit-webapp/WEB-INF/jsp/metadata.jsp and noticed that when I put the following lines of code:

   if (acceptHeader != null && !acceptHeader.contains("application/samlmetadata+xml")) {
       response.setContentType("application/xml");
   } else {
       response.setContentType("application/samlmetadata+xml");
   }

(lines 34-39 in version 4.3.1)

before the xml output is written (i.e. between line 14 and 15). The content-type header is emmited correctly. Like I said, I’m not sure if this issue is related to tomcat but it can be fixed this way…

( https://shibboleth.atlassian.net/browse/IDP-2135#add-comment?atlOrigin=eyJpIjoiZTdjODc2OTMyMzU4NDY4Mjk5MTc0ODlmYjgxODU1NjMiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/IDP-2135#add-comment?atlOrigin=eyJpIjoiZTdjODc2OTMyMzU4NDY4Mjk5MTc0ODlmYjgxODU1NjMiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100227- sha1:674e4eb )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20230628/9d479b0b/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-91b6d19e-ff4c-4d52-8a8b-2d9ccab622b6
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230628/9d479b0b/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-b30704e6-7bf9-44a2-b569-df3a22141e0d
Type: image/png
Size: 345 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230628/9d479b0b/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-17d58978-5f57-4e57-a503-8d96b86b91a2
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230628/9d479b0b/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-low-77d9eadf-e65c-478d-ab92-2cd05f563e3d
Type: image/png
Size: 248 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230628/9d479b0b/attachment-0007.png>