Shibboleth 2.4.3 SP, Oracle Identity Federation 11g IDP SAML1.1 and TARGET

[Cantor, Scott]

On 10/5/11 12:19 AM, "Nicholas Irving" <nirving at darkedges.com> wrote:
>
>As you can see the request contains the TARGET parameter, but as part of
>the URL and not the POST. So the question is, is this Shibboleth being
>true to the SAML 1.1 spec and requiring TARGET to be POST'd or has it
>missed a trick and this is a valid request?

The SP isn't intentionally being that strict about it, but the CGI parser
in 2.4 doesn't have the ability to handle both form parameters and query
string parameters in a POST. It sees POST and just goes to the body.
That's being enhanced in 2.5.

Not that they're following the standard, just noting it.

-- Scott