Safari dropping POST variables when accessing ColdFusion9 scripts behind Shibboleth

[Basole, Milind M]

Greetings,

I am writing today about an application scripted in ColdFusion 9 making
extensive use of AJAX/jQuery. We've recently migrated to Shibboleth AuthN
from a homegrown Kerberos based system that served Illinois for many
years. For the most part transition has been smooth and we're looking
forward to the opportunities that SSO opens up for us. However, we have
noticed a bit of peculiarity that I am hoping esteemed Shibboleth users
worldwide would be able to shed light on. Please read on for details.
We have noticed that form variables POSTed to our CF scripts get dropped
on their way from Safari browser via Shib SAML handlers. This issue is not
seen in other browsers (Chrome, Firefox and IE). With no form variables,
the user's submissions are lost, causing much heartache. PHP on the other
hand exhibits consistent (and correct) behavior across all browsers. Thus,
for a Shib protected directory 'foo', we have:
http://foo/bar.cfm will have access to POST variables when posted from
Chrome, FF and IE ­ but not from Safari.
http://foo/bar.php will have access to POST variables across all browsers.
We're not sure what is happening in the trip between the browser to the
CFM scripts via SAML handlers and why is only Safari being affected, that
too only when used in conjunction with CF9. Any thoughts, experiences or
workarounds you can share will be most appreciated. If it matters, we're
running ColdFusion 9 on RHEL6.4. Our Shibboleth SP is v2.5.2-1.1.el5.

Thank you.
Milind Basole
eText Group
CITES Academic Technology Services
University of Illinois at Urbana-Champaign
2304 Digital Computer Laboratory ­ MC 256
1304 W. Springfield Ave, Urbana IL 61801
basole at illinois.edu
217-244-6543
https://etext.illinois.edu