SHibboleth IdP 3.0/Jetty 9.2 SAML Response Issue

[Cantor, Scott]

> I'm fairly certain that's not new. I noticed it, and assumed it was a bug but am
> fairly sure I went back and checked V2 and found the same thing. If not, I
> don't know how such a change would have been introduced unless it's got
> something to do with the underlying credential file it's loading.

Assuming I'm wrong about V2, which is likely, I believe the underlying change is in the base64 routine used to populate the KeyInfo. In V2, we used a copied-in Base64 encoder and it used LF alone as the chunked separator.

In V3, we're using the Apache codec Base64 implementation, and CHUNKED there uses CRLF as the separator. So that's where it's coming from.

I would prefer that we change that, but I don't think we can without switching codec implementations.

It doesn't violate any XML Signature rules, the reference to Base64 there is fairly generic.

-- Scott