proper encoding of ACS URL in metadata and AuthnRequest

[Sean McHugh]

I have an SP that needs to use parameters in the ACS URL.  Luckily, they
are capable of encoding it but we haven't been able to get it right.

The desired ACS url is, without encoding is:

https://secure.terranovasite.com/LMS/login/saml2/tnsso_ACS.aspx?e=561e8185-621e-49c1-9856-7013f9d8491&lang=en&t=1

In the AuthnRequest and metadata, we are using:

https://secure.terranovasite.com/LMS/login/saml2/tnsso_ACS.aspx?e=561e8185-621e-49c1-9856-7013f9d8491c%26lang=en%26t=1

However, it appears that when this URL is processed by Velocity, the '%' is
re-encoded again and it ultimately yields the following URL:

https://secure.terranovasite.com/LMS/login/saml2/tnsso_ACS.aspx?e=561e8185-621e-49c1-9856-7013f9d8491&lang


What is the proper encoding to use in the AuthnRequest and metadata?

For reference, I've included logs:


01:48:19.909 - DEBUG
[org.opensaml.saml2.binding.AuthnResponseEndpointSelector:69] - Selecting
endpoint by ACS URL '
https://secure.terranovasite.com/LMS/login/saml2/tnsso_ACS.aspx?e=561e8185-621e-49c1-9856-7013f9d8491c%26lang=en%26t=1'
and protocol binding 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST' for
request 'https://secure.terranovasite.com/lms/login/saml2/' from entity '
https://secure.terranovasite.com/lms/login/saml2/'
01:48:20.060 - DEBUG [org.opensaml.common.SAMLObjectHelper:56] - Examing
signed object for content references with exclusive canonicalization
transform
01:48:20.060 - DEBUG [org.opensaml.common.SAMLObjectHelper:70] - Saw
exclusive transform, declaring non-visible namespaces on signed object
01:48:20.067 - DEBUG
[org.opensaml.xml.signature.impl.SignatureMarshaller:100] - Starting to
marshall {http://www.w3.org/2000/09/xmldsig#}Signature
01:48:20.068 - DEBUG
[org.opensaml.xml.signature.impl.SignatureMarshaller:103] - Creating
XMLSignature object
01:48:20.068 - DEBUG
[org.opensaml.xml.signature.impl.SignatureMarshaller:113] - Adding content
to XMLSignature.
01:48:20.069 - DEBUG
[org.opensaml.common.impl.SAMLObjectContentReference:174] - Adding list of
inclusive namespaces for signature exclusive canonicalization transform
01:48:20.072 - DEBUG
[org.opensaml.xml.signature.impl.SignatureMarshaller:118] - Creating
Signature DOM element
01:48:20.077 - DEBUG [org.opensaml.xml.signature.Signer:76] - Computing
signature over XMLSignature object
01:48:20.096 - DEBUG
[org.opensaml.ws.message.encoder.BaseMessageEncoder:49] - Beginning encode
message to outbound transport of type:
org.opensaml.ws.transport.http.HttpServletResponseAdapter
01:48:20.097 - DEBUG
[org.opensaml.saml2.binding.encoding.HTTPPostEncoder:124] - Invoking
Velocity template to create POST body
01:48:20.146 - DEBUG
[org.opensaml.saml2.binding.encoding.HTTPPostEncoder:158] - Encoding action
url of '
https://secure.terranovasite.com/LMS/login/saml2/tnsso_ACS.aspx?e=561e8185-621e-49c1-9856-7013f9d8491c%26lang'
with encoded value 'https://secure.terranovasite.com
/LMS/login/saml2/tnsso_ACS.aspx?e=561e8185-621e-49c1-9856-7013f9d8491c%26lang'
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140128/72bce77d/attachment.html