ECP issue with current opensaml-soap-impl

[Cantor, Scott]

On 11/7/16 4:54 PM, Kim, Allan wrote:
> At UCSD we’ve run into some unexpected behavior while testing ECP with
> IdP 3.3.0-SNAPSHOT. The latest opensaml-soap-impl has added content type
> validation for SOAP requests in HTTPSOAP11Decoder, and accepts only
> text/xml as a valid type. I’m sure this is technically correct for SOAP
> 1.1

It's much more than that, it prevents containers from doing bad things
to the body before the code can run. Tolerating it costs us support time
and money.

> Is it possible to turn either content type validation or
> SUPPORTED_MEDIA_TYPES into configurable options? This would allow IdP
> deployers to support slightly out-of-spec clients while allowing other
> OpenSAML users to enforce strict validation when desired.

If you want to support them, you can put a Java filter into your
container to override what the client sent.

-- Scott