Base64 encode SAML Response problems?

[o haya]

 Hi Scott and Brent,
I wanted to be very clear that I definitely understand where you both are coming from, and appreciate your frank comments.  As I said, what you conveyed was basically the same as what I had been voicing from the beginning.  Also, FYI, I did raise this again (actually several times), and after much discussion, I know that everyone here understands, but they (and I, now) also recognize that this is "an unusual situation" and they have assured me that this is a one-off and they are saying that they think that it is only going to be a stopgap/temporary solution (but I've been around long enough to know that may or may not turn out that way :)).
Also, just to let you know, I was able to get this working late last night/this morning.  The problem turned out to be that I had missed some attributes on the Response element/node, so the problem was not Base64-encoding or URL-encoding related.  I guess I had been staring at those captures for so long that I had mentally skipped over those :).
So, I want to thank both of your for your help with this.  This has been a kind of "long slog" and I lost a lot of sleep (and probably hair :)!), and  I had my best night's sleep this morning in a long time!!

Thanks again,Jim


    On Tuesday, February 19, 2019, 9:21:44 AM EST, Cantor, Scott <cantor.2 at osu.edu> wrote:  
 
 > It's hard to explain "Why?" I am doing what I am trying to do, but your guesses
> were somewhat close.  I do understand what you are saying, and I had
> suggested that if "they" wanted to do this, they should just go ahead and help
> our partner stand up an IDP on their end instead, but I was over-ridden and so,
> naturally, I got stuck with it :)...

You need to be much more vocal with them about how big a mistake this is. The chance of insecurity is extremely high. If it helps sell the argument, this is the primary author of the standard saying this. Don't do this. If you need a SAML proxy there are already free solutions for that that are well tested and maintained, like SimpleSAML.php and SATOSA.

-- Scott

-- 
To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net
  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20190221/a1521a0c/attachment.html>