Problem URL with # on login shibboleth

[Teresa Fasano]

Il 29/07/2015 15:37, Peter Schober ha scritto:
> * Teresa Fasano <t.fasano at cineca.it> [2015-07-29 15:00]:
>> When the user needs to log on  to the IDP it is redirected to https://<url>,
>> losing all part of the url after "#".
>> Instead, if the user is already logged on the IDP it is correctly redirected
>> to the original URL, including the character "#".
> Re-reading this you're saying that the SP keeps the "correct" (incl
> the fragment identifier) URI if the browser has an SSO session at the
> IDP, but the URI is missing the fragment identifier if I have to enter
> credentials at the IDP?

Yes, it is.
If I have to log in (enter credentials on the login page), after the 
authentication the URL becomes https://<url> without the part relating 
to the character #.
Instead,if I'm already authenticated, the URL is "https: // <url> = # 
filter ....".
>
> I don't see how that's possible. The data sent and received from the
> SP to the IDP and back would be the same (modulo differences wrt
> Assertion/@IssueInstant and AuthnStatement/@AuthnInstant, which should
> be irrelevant to this behaviour) whether I had to authenticate with
> the IDP or had an SSO session established with the IDP earlier.
>
> Also, since the SP doesn't know whether my browser will experience SSO
> at the IDP or not, it would need to perform the same steps to save off
> the accessed URI and reference it in the RelayState sent to the IDP.
> -peter


-- 
----------------------------------
L'educazione è il pane dell'anima
----------------------------------

Teresa Fasano

CINECA
System and Technologies Department
Middleware and Infrastructure Group
Via Magnanelli, 6/3
Casalecchio di Reno (Bologna) ITALY

web:     http://www.cineca.it
e-mail:  t.fasano at cineca.it
phone:   +39 051 61 71 364

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150729/f5643869/attachment-0001.html>