Centralized Discovery Service and URL decoding

[Wessel, Keith]

Hi, all,

We're having a problem with the Shib Centralized DS and doubly-encoded URLs. A string that we're encoding twice because it's supposed to still be URL-encoded when it gets back to the SP seems to be decoded.

We use the Shib centralized discovery service in front of our university's enterprise Box account because the three Illinois campuses, each with their own IDP, share the enterprise account. Box, in the beta of their new sync service, has the need to include a parameter as part of the return URL that is, itself, another URL. They want that parameter value to remain URL-encoded when it gets back to them.

Of course, the DS also expects the return URL to be URL-encoded. So, the smart folks at Box decided they'd just encode the parameter, then encode the whole return URL string. End result: the parameter is now doubly encoded.

Funny thing is that, by the time the return URL gets back to Box, even the parameter seems to be completely decoded... as if the DS id decoding twice.

So, they're seeing the DS returning to this:
https://sso.services.box.net/sp/startSSO.ping?TargetResource=https://www.box.com/api/oauth2/authorize?response_type=code&client_id=pbwjkgj4xxa9jifscs2zv3dzq1t96ykc&redirect_uri=https%3A%2F%2Fgoogle.com%2F&PartnerIdpId=urn:mace:incommon:uiuc.edu

Instead, they're expecting the returnX URL parameter to be URL decoded once like this
https://sso.services.box.net/sp/startSSO.ping?TargetResource=https%3A%2F%2Fwww.box.com%2Fapi%2Foauth2%2Fauthorize%3Fresponse_type%3Dcode%26client_id%3Dpbwjkgj4xxa9jifscs2zv3dzq1t96ykc%26redirect_uri%3Dhttps%253A%252F%252Fgoogle.com%252F&returnIDParam=PartnerIdpId&action=selection&select=Select this campus&cache=session

Is the DS doing some logic after it decodes the return URL to see if it still seems to have further decoding in it and, if it does, looping through again? Or do we need to look beyond the DS to find the source of this craziness?

Thanks,
Keith

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131026/44158960/attachment-0001.html