Google Generates Warning: Relay state exceeds 80 bytes, some application may not support this.

[Ullfig, Roberto]

Hello,

just getting around to looking at this warning we've been getting for years. Everything has been working fine but every Google login generates one of these warnings:

WARN [org.opensaml.saml2.binding.encoding.BaseSAML2MessageEncoder:134] - Relay state exceeds 80 bytes, some application may not support this.

    <rp:RelyingParty id="google.com"
        provider="https://shibboleth.uic.edu/shibboleth"
        defaultSigningCredentialRef="IdPCredential"
        defaultAuthenticationMethod="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport">
        <rp:ProfileConfiguration xsi:type="saml:ShibbolethSSOProfile" />
        <rp:ProfileConfiguration xsi:type="saml:SAML1AttributeQueryProfile" />
        <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile" encryptAssertions="never" encryptNameIds="never" />
        <rp:ProfileConfiguration xsi:type="saml:SAML2AttributeQueryProfile" />
    </rp:RelyingParty>


<!-- Google Apps -->
<!-- Do not release transientID to google.com - things break -->
    <afp:AttributeFilterPolicy id="google.com">
        <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="google.com" />
        <afp:AttributeRule attributeID="principal"> <afp:PermitValueRule xsi:type="basic:ANY" /> </afp:AttributeRule>
    </afp:AttributeFilterPolicy>

We've commented out the releaseTransientIdToAnyone policy and explicitly release transientID in all other policies. Other SP logins do not generate this message.

What's the cause and is there a solution?


---
Roberto Ullfig - ACCC Research Programmer
rullfig at uic.edu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131018/6cf91129/attachment.html