Relaystate Problem

[Cantor, Scott]

On 10/15/12 4:47 AM, "Rainer Hoerbe" <rainer at hoerbe.at> wrote:

>I have a shib SP with 2 vHosts with a separate ApplicationOverride for
>each one. There are different IDPs configured for each SP, both using
>POST/POST binding for AuthnRequest/Repsonse. IDP2 is Shibboleth, IDP1 is
>not.

Do you have a reason other than setting the IdP to use for using the
override?

>Problem: Other than IDP1, the interaction with IDP2 does not preserve the
>path, but returns to /. I cannot find any problem in the IDP's response.
>
>When I trace the interactions, both show that the POST to the SP's ACS
>includes the _shibstate cookie with the correct path.
>
>Any idea how to find the problem?

Normally it would mean there's a mapping issue, the override isn't taking
effect properly.

But since it's not looping, and assuming the logs show it mapping requests
to the expected application, I would guess the non-Shib IdP is corrupting
the RelayState value and preventing it from reading back the cookie.

-- Scott