Relaystate Problem

[Rainer Hoerbe]

Am 15.10.2012 um 18:49 schrieb "Cantor, Scott" <cantor.2 at osu.edu>:

>> How could I find out more? In the log I can see only the redirect to the
>> root context:
>> DEBUG Shibboleth.SSO.SAML2 [8]: ACS returning via redirect to:
>> https://storksaml2.portalverbund.at/
> 
> native.log reports on what app ID every request is mapped to.


First, the initial resource URL was mapped to the correct path:
Shibboleth.Apache [20999] shib_check_user: mapped https://storksaml2.portalverbund.at/secure/echo.php to storksaml2

Second, the ACS digested the Response:
Shibboleth.Apache [21001] shib_check_user: mapped https://storksaml2.portalverbund.at/Shibboleth.sso/SAML2/POST to storksaml2

Third, the original mapping seems to be lost:
Shibboleth.Apache [21001] shib_check_user: mapped https://storksaml2.portalverbund.at/ to storksaml2


> 
>> Not likely. The Set-Cookie from the initial SP response and the
>> Cookie-header from the POST to the SP's ACS show identical values.
>> Also,how would it be possible that the IDP interferes with the _shibstate
>> cookie? It is not in the IDP's domain.
> 
> The cookie value is not the relay state, the cookie *name* is.
Both name and value are identical.

For my understanding: Doesn't <SessionInitiator relayState="cookie" ...> specify to use the cookie to store the resource path in the cookie? It looks very much like this:
Cookie: _shibstate_1350286969_c8e2=https%3A%2F%2Fpvpsaml2.portalverbund.at%2Fsecure%2Fecho.php

Thanks, Rainer