Relaystate Problem

[Rainer Hoerbe]

I have a shib SP with 2 vHosts with a separate ApplicationOverride for each one. There are different IDPs configured for each SP, both using POST/POST binding for AuthnRequest/Repsonse. IDP2 is Shibboleth, IDP1 is not.

Problem: Other than IDP1, the interaction with IDP2 does not preserve the path, but returns to /. I cannot find any problem in the IDP's response.

When I trace the interactions, both show that the POST to the SP's ACS includes the _shibstate cookie with the correct path.

Any idea how to find the problem?

- Rainer

============ IDP1: STORKSAML2 (POST/POST) ==============
> GET https://storksaml2.portalverbund.at/secure/echo.php
<200 OK 
<	Set-Cookie:	_shibstate_1349509693_3e5a=https%3A%2F%2Fstorksaml2.portalverbund.at%2Fsecure%2Fecho.php; path=/; secure; HttpOnly
<	Content: Form POST RelayState=cookie%..., SAMLRequest=...

... IDP authentication (https://apps.egiz.gv.at/moa.stork.web-test/SendPEPSAuthnRequest etc ...)

>POST https://storksaml2.portalverbund.at/Shibboleth.sso/SAML2/POST
>	Cookie:	_saml_idp=aHR0...; 
>			_shibstate_1349509693_3e5a=https%3A%2F%2Fstorksaml2.portalverbund.at%2Fsecure%2Fecho.php; 
>	Postdata: SAMLResponse
<302 Found
<	Set-Cookie:	_shibsession_73746....=_598e7e75....; path=/; secure; HttpOnly 
<    			_saml_idp=aHR0...; path=/; secure; expires=Sat, 03 Nov 2012 07:52:04 GMT

>GET https://storksaml2.portalverbund.at/
>	Cookie:	_saml_idp=aHR0...; 
>			_shibstate_1349509693_3e5a=https%3A%2F%2Fstorksaml2.portalverbund.at%2Fsecure%2Fecho.php; 
>			_shibsession_73746...=_598e7e757ab45eb4287d4cd7797c2613
		
		
		
============ IDP2: PVPSAML2 (POST/POST) ==============

>GET https://pvpsaml2.portalverbund.at/secure/test.php
<200 OK (Form-POST)
<	Set-Cookie=_shibstate_1350286969_c8e2=https%3A%2F%2Fpvpsaml2.portalverbund.at%2Fsecure%2Fecho.php; path=/; secure; HttpOnly
<	Content: Form POST RelayState=cookie%..., SAMLRequest=...

... IdP authentication (https://testshib.portalverbund.at/idp/profile/SAML2/POST/SSO)


>POST https://testshib.portalverbund.at/idp/profile/SAML2/POST/SSO
>	Cookie: _shibstate_1350286436_cc18=https%3A%2F%2Fpvpsaml2.portalverbund.at%2Fsecure%2Ftest.php;
>	Postdata: SAMLResponse
<302 Found
<	Set-Cookie: _shibsession_7076707...=_b0f32f0c0e4ce57b41af92866d887f52; path=/; secure; HttpOnly
				_saml_idp=aHR0c...; path=/; secure; expires=Mon, 12 Nov 2012 07:42:51 GMT
				_shibstate_1350286969_c8e2=; path=/; secure; HttpOnly; expires=Mon, 01 Jan 2001 00:00:00 GMT

>GET https://pvpsaml2.portalverbund.at/secure/test.php
>	Cookie:	_shibsession_7076707...=_a2a16e79d1bc069fcc0bf56245983472; 
>			_saml_idp=aHR0...
<200 OK