proper encoding of ACS URL in metadata and AuthnRequest

[Cantor, Scott]

On 1/28/14, 2:10 AM, "Sean McHugh" <sean8sean at gmail.com> wrote:
>
>In the AuthnRequest and metadata, we are using:
>
>https://secure.terranovasite.com/LMS/login/saml2/tnsso_ACS.aspx?e=561e8185
>-621e-49c1-9856-7013f9d8491c%26lang=en%26t=1

That's not valid. You have a mix of encoding there. By passing that in,
the eventual URL is not going to contain "&" symbols or be handled as a
query string.

>What is the proper encoding to use in the AuthnRequest and metadata?

You don't, in general, those are meant to be the unadorned actual URLs.

That doesn't absolve you of properly encoding the data for XML, which is
probably where you got it wrong, per Paul's comment. Ampersands must be
encoded as &amp;

That's not URL encoding, it's XML encoding.

-- Scott