Shib IdP 2.4.3 and ECP extension

[Cantor, Scott]

On 11/12/14, 7:46 PM, "Prasanna" <PVBalachandar at imperosoftware.com> wrote:
>
>Shibboleth IdP ECP extensions is used in O365 for autodiscovery. It was
>working fine with Shib 2.4.2 version but when I upgraded to 2.4.3,
>auto-discover didn't work. Hope I explained better.

Not really, no, that is not a technical description of a specific problem 
derived from researching your logs, tracing activity, etc.

If I had to take a wild guess, it would be that applying the upgrade and 
changing the parser as described broke Microsoft's ECP client, which would 
mean they have a bug.

An obvious thing to do is to not change the parser, return things to the 
original state while using the upgraded code, mitigate the security issue 
with the POST limiting workaround described in th advisory, and see what 
happens.

-- Scott