Relaystate Problem

[Rainer Hoerbe]

Am 15.10.2012 um 15:32 schrieb "Cantor, Scott" <cantor.2 at osu.edu>:

>> I have a shib SP with 2 vHosts with a separate ApplicationOverride for
>> each one. There are different IDPs configured for each SP, both using
>> POST/POST binding for AuthnRequest/Repsonse. IDP2 is Shibboleth, IDP1 is
>> not.
> 
> Do you have a reason other than setting the IdP to use for using the
> override?

Yes, IDP1 requires a custom AuthnRequest (attribute request); iDP2 is plain vanilla.

>> Problem: Other than IDP1, the interaction with IDP2 does not preserve the
>> path, but returns to /. I cannot find any problem in the IDP's response.
>> 
>> When I trace the interactions, both show that the POST to the SP's ACS
>> includes the _shibstate cookie with the correct path.
>> 
>> Any idea how to find the problem?
> 
> Normally it would mean there's a mapping issue, the override isn't taking
> effect properly.

How could I find out more? In the log I can see only the redirect to the root context:
DEBUG Shibboleth.SSO.SAML2 [8]: ACS returning via redirect to: https://storksaml2.portalverbund.at/

> 
> But since it's not looping, and assuming the logs show it mapping requests
> to the expected application, I would guess the non-Shib IdP is corrupting
> the RelayState value and preventing it from reading back the cookie.

Not likely. The Set-Cookie from the initial SP response and the Cookie-header from the POST to the SP's ACS show identical values. Also,how would it be possible that the IDP interferes with the _shibstate cookie? It is not in the IDP's domain.

- Rainer

> 
> -- Scott