<div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">If the "service" param in the initial request to login is URL encoded,<br>
the example service definition[2] obviously won't match.<br></blockquote><div><br></div><div>Short answer: I don't believe there would be a problem since IIRC URL decoding is an implicit part of the servlet request processing pipeline. </div><div><br></div><div>Long answer follows.</div><div><br></div><div>Registered services commonly contain a scheme, host, and path and nothing more like the following:</div><div><br></div><div><a href="https://rp.example.com/path.*">https://rp.example.com/path.*</a></div><div><br></div><div>A CAS protocol request for that service might look like the following:</div><div><br></div><div><a href="https://idp.example.com/idp/profile/cas/login?service=https://rp.example.com/path/start">https://idp.example.com/idp/profile/cas/login?service=https://rp.example.com/path/start</a></div><div><br></div><div>That is a valid URL since '/' and ':' are legal query string characters per RFC 3986 [1]. However, since the CAS client component is responsible for constructing the URL above, you're at the whim of the client. Some clients encode the '/' and ':' characters, others do not; it's about 50:50 in my experience. If the service URL contained a query delimiter, '?', it would have to be encoded, but that's usually ignored anyway due to the wildcard ".*" at the end of the registered service regex.</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Should there be a service definition which URL decodes first before matching ?<br></blockquote><div><br></div><div>Good question. I _thought_ that URL decoding was a built-in facility of most servlet containers. In that view, even if the client sends a request line like</div><div><br></div><div>/idp/profile/cas/login?service=https%3A%2F%<a href="http://2Frp.example.com">2Frp.example.com</a>%2Fpath%2Fstart</div><div><br></div><div>by the time HttpServletRequest#getParameter("service") is called, you ought to get the decoded URL. I believe I verified that recently. Are you seeing something different in your testing?</div><div><br></div><div>M<a href="mailto:dev-unsubscribe@shibboleth.net" target="_blank"></a><br>
</div><div><br></div><div>[1] <a href="http://tools.ietf.org/html/rfc3986#appendix-A">http://tools.ietf.org/html/rfc3986#appendix-A</a></div><div><br></div></div>