URL-encoded RelayState values

[Chad La Joie]

If the IdP is using the POST binding to send the response to the SP
than the relay state should be in the body and would be form encoded
not URL encoded.

On Wed, Jul 25, 2012 at 5:33 AM, Andrew Webb <Andrew.Webb at statpro.com> wrote:
> An IdP we interoperate with is not echoing back the Shib SP request’s
> RelayState value in its POSTed SAML response.  I will get this changed.  But
> a question…  the value in the GET request is something like this:
> “ss%3Amem%3A29002348be188467e14a6c3dd62cae72”.  We can see that two
> instances of a certain character are URL-encoded to %3A.  Should the IdP be
> echoing back the URL-encoded value (as above), or the URL-decoded value?  A
> reading of the spec strongly suggests the former, but I thought I would
> check with you, because Googling around, there seems to be some confusion
> about this.  I can see that some systems have had to be bug-fixed in this
> regard, but I haven’t been able to tell what the fixes were.
>
>
>
> My reading is that the exact value has to be echoed back, and if that value
> is URL-encoded, then the URL-encoded value has to be sent back.  Correct?
>
>
>
>
>
>
>
> This message is private and confidential. If you have received this message
> in error, please notify us and remove it from your system. Any views or
> opinions presented in this email are solely those of the author and might
> not represent those of StatPro. Warning: Although StatPro has taken
> reasonable precautions to ensure no viruses are present in this email, the
> company cannot accept responsibility for any loss or damage arising from the
> use of this email or attachments.
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net



-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered