Attributes not appearing in .Net Request.Headers collection

[Martin Robinson]

Scott,

In fact, the missing attributes were really caused by the fact that the extra whitespace at the front of their values contained a line-feed! Hence, I guess the values appeared blank to IIS. But it would have been nice to at least have included the header name in the AllKeys array to tell me that it had a blank value. Grrrrrr!!!

I actually tried adding 'ö' (an o-umlaut) into an attribute value in the SAML Response xml, and it correctly appeared as an Ö in the .Net headers collection. It would thus appear that .Net layer is properly decoding any UTF-8 before passing it to the application. So Non-ASCII characters appear to just work - but non-printable ones like line-feeds may not.

So - I just wasted several days of effort all because Notepad++'s 'HTML Tidy / Reindent XML' feature saw fit to wrap lines INSIDE an element's value without me noticing. 

Anyway - I've learnt quite a lot about Shibboleth's source code and how to build it! (more than I really wanted to know...)

Many thanks for your help on this,

Martin Robinson


-----Original Message-----
From: dev [mailto:dev-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: 10 June 2015 16:14
To: Shib Dev
Subject: Re: Attributes not appearing in .Net Request.Headers collection

On 6/10/15, 10:51 AM, "dev on behalf of Martin Robinson" <dev-bounces at shibboleth.net on behalf of martin.robinson at dai.co.uk> wrote:

>I got my debug build of isapi_shib.dll working, and very quickly found the problem...

Sorry for doubting you...

>The call to m_pn->SetHeader in isapi_shib.cpp was returning TRUE (success), yet the attribute was not appearing in the .net Request.Headers collection. Somewhere within IIS and/or .Net, headers are being removed or ignored if their value starts with a space!

That sounds plausible certainly.

>Is this perhaps because attribute values should actually be URL-Encoded?

It's not really that well-defined, but spaces certainly work in general in header values.

>A more general question: How SHOULD attribute values be handled if they contain non-ASCII characters, such as a name like "Süß"? Will they appear in the .Net headers collection as UTF-8 or what?

The data extracted from the XML is stored as Unicode data and encoded as UTF-8 when it's expressed in an 8-bit string. By default, that's all it does, it's passed as is into the header value.

An option was added a while ago to tell the SP to URL-encode the values when it creates the headers. You have to put encoding="URL" into the RequestMap as a setting. In this specific instance, that would probably fix it, at the cost of requiring your application code to reverse the encoding.

-- Scott

-- 
To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net