Centralized Discovery Service and URL decoding

[Wessel, Keith]

Thanks, Rod, I suspect this is the problem. After seeing your note, I looked at wayf.jsp that ships with the DS, and I see what you're talking about. I foolishly dropped our old wayf.jsp in place. I'm going to test using your stock wayf.jsp to see if that fixes the problem and, if so, rebrand from there.

Thanks again, both Rod and Scott.

Keith


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Rod Widdowson
Sent: Wednesday, October 30, 2013 5:01 AM
To: 'Shib Users'
Subject: RE: Centralized Discovery Service and URL decoding

It is not beyond the realms of possibility that there is a bug in the DS -
but we have been clean of these since
https://issues.shibboleth.net/jira/browse/SDSJ-109 (which was double
encoding and was fixed in 1.2.1

Most of the encoding happens in the jsp layer and so if you have amended
that you might want to look at any customizations, especially (As indicated
in the above) the relationship between the ESAPI encoders and <bean:write>.

I'd suggest that you capture a login and watch the URI being passed around.
In particular check the parameters "return" (on the way to the CDS) and
"returnX" (during the dispatch back to the SP).  That might help point out
where the issue occurs (they should be the same).

The UK Federation runs the CDS but with its own JSP, and I am not aware that
they are having any issues.

Rod

> -----Original Message-----
> From: users-bounces at shibboleth.net [mailto:users-
> bounces at shibboleth.net] On Behalf Of Wessel, Keith
> Sent: 29 October 2013 21:30
> To: Shib Users
> Subject: RE: Centralized Discovery Service and URL decoding
> 
> Thanks for giving us another checkpoint here, Scott. I suppose I could
have
> tried that same test.
> 
> Our DS installation is quite standard and, though parts of it go back to
the
> original one, our test DS instance is freshly installed last week in hopes
that
> this would fix the problem. Only some of the original branding is the
same.
> 
> Can someone at InCommon confirm for us that the InCommon DS is using
> the Shib centralized DS software? If that's the case, I'll have to dig
deeper to
> see how we broke things on our side. If not, I agree that we most likely
have
> a bug, and I'll file a bug report.
> 
> Thanks again,
> Keith
> 


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net