escape chars in authN

[Mike Flynn]

I recently setup a connection with a new IDP and sent them an SP init link.  They responded with this:


We’re having a problem on our end with the request URL that your SAML server is creating.  The SAMLRequest parameter consistently contains several %0A escape characters, which, when decoded, are newline characters.  These are generally not allowed as they are used by hackers to try to hijack code, and our Forefront TMG firewall proxy doesn’t allow them at all.
 
Can your system be configured to not use either the %0A or %0D escape characters?  (I didn’t see the latter one, only the first, but I’ve included it for completeness.)  If you are able to double escape the parameter so that the percent sign is rendered as %25 creating %250A, we can probably prevent our firewall from double decoding the URL, if that’s any help.
 
Let me know what you think.

And, indeed, this is the case.  Here is the authN sent to them:
SAMLRequest=fZFfT4MwFMW%2FCuk7FNhQ1wwS3B5cMpUM9MEXU0oZTUqLvcW5by8D%2F8wH93jT%0Ac88599cl0FZ2JO1to3b8redgnY9WKiDjQ4x6o4imIIAo2nIglpE8vd%2BS0PNJ%0AZ7TVTEvkpADcWKHVSivoW25ybt4F40%2B7bYwaazsgGEMjSk8eVUU9plucD2Op%0AJbeNB6DxyTXE2WNeIGc91BCKngx%2F12lVg3cQ0Hja7McJS8DI2axj9DqrwkXA%0A%2FBkvF1U0Z2U9Cxe8Dug1q0q%2FnLNBBtDzjQJLlY1R6AeR6weuf1UEEQkjMr95%0AQU72ddCtUJVQ%2B8vXl5MIyF1RZO5U%2FJkbGEsPApQsTwzJGGzOqF62pd8oUfIP%0AOPgB50K3xGchU2JHHgbXzTrTUrCjk0qpDyvDqeUxChBOppW%2Fn558Ag%3D%3D%0A&RelayState=cookie%3Aa3539135

Now, just for grins I looked at authN for a number of other connections.  They all do this and the IDPs seems to be fine with it.  Is there any way to disable these escape chars for this this one IDP using a relying party rule or anything?  My searching has not uncovered anything useful :(
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150106/5cb6d2e0/attachment.html