SHibboleth IdP 3.0/Jetty 9.2 SAML Response Issue

[Cantor, Scott]

> I have an issue regarding the SAML Authentication response sent from one
> Shibboleth IdP instance towards an SP instance.
> The problem is that the signing X509 cert is sent with encoded carriage
> returns at the end of each line:

I'm fairly certain that's not new. I noticed it, and assumed it was a bug but am fairly sure I went back and checked V2 and found the same thing. If not, I don't know how such a change would have been introduced unless it's got something to do with the underlying credential file it's loading.

> Here is a line from the X509 cert sent on the SAML response (which is a
> Success):

Yes, and it works. The Shibboleth SP has had no issue with it, and I don't see why anything would. It's just base64, and whitespace is ignored. If it's a change, I would prefer we try and get rid of it, but it should not break anything that isn't itself broken.

> The signature itself is clean (no CRs), so the IdP successfully loads the signing
> credentials.

I don't know what that means.

> I suspect the opensaml-saml-impl library is built on a Win platform (by looking
> at the manifest in the jar).

I don't think it could have been, Brent built it (IIRC), and he wouldn't have.

-- Scott