Shibboleth SSO server adds "=" after query string

[Virajitha Sarma]

Hi All,

One of our customer has configured our application with Shibboleth SSO to
achieve single sign on application. He has raised an issue that login is
not successful when the user needs to be redirected to the uri mentioned in
the "redirect" query string after successful login. The redirection is made
to a apache-CAS server http://cas.example.com (configured with
mod_auth_cas).

This is the url that shibboleth server gets at login page:
https://shib.example.com/sso/module.php/core/loginuserpass.php?redirect="
http://cas.example.com/library?field1=value1&1,,2,2,0"

In our analysis we found that the reason was that: the redirect url has a
query string without values something like:
http://cas.example.com/library?field1=value1&1,,2,2,0 and when login was
done, shibboleth server added "=" like
http://cas.example.com/library?field1=value1&1,,2,2,0*=* by assuming that
"1,,2,2,0" to be an empty key.  Apache-CAS server throws error when it
finds a change in the url that is returned by the shibboleth.

Error thrown by CAS server :
response = <?xml version="1.0"?>\n<cas:serviceResponse xmlns:cas="
http://www.yale.edu/tp/cas">\n<cas:authenticationFailure
code="INVALID_SERVICE">Mismatching service parameters: expected '
https://cas.example.com/library?redirect=https://cas.example.com:443/library?/pblackwell/pblackwell/1,1,2,B/l962~1070705&FF=pblackwell+pamela&1,,2,0,0'
but was: 'https://cas.example.com:443/library?%2F0%2Fredirect=https%3A%2F%2F
cas.example.com:443/library
%3F%2Fpblackwell%2Fpblackwell%2F1%2C1%2C2%2CB%2Fl962%7E1070705&FF=pblackwell+pamela&1%2C%2C2%2C0%2C0='</cas:authenticationFailure>\n</cas:serviceResponse>,

​If we change the redirect url to ​"
http://cas.example.com/library?field1=value1&1,,2,2,0=" (with an equal to
at the end). so that the shibboleth server gets redirect query param with
"=", then login happens successfully. Something like
https://shib.example.com/sso/module.php/core/loginuserpass.php?redirect="
http://cas.example.com/library?field1=value1&1,,2,2,0="


​According to the URI spec RFC 3986 here
<http://tools.ietf.org/html/rfc3986#section-3.4>​, there is no rule that an
uri should always contain key=value pairs. We can mention just key to know
the presence of some parameter. Since our application can be configured
with other SSO servers also and also it is not industry standard to always
have key=value pairs, we donot think it will be a good idea to change our
application to include "=" after param "1,,2,2,0".  Could you please let us
know what configuration changes should be done at Shibboleth server that we
can convey to our customers to solve this issue.


Thanks and Regards,
Virajitha


-- 

Regards,
Virajitha
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20180105/d2c0ad2e/attachment.html>