HTTP Redirect Binding and URL Length

[Brent Putman]

On 11/10/16 10:42 AM, Cantor, Scott wrote:
>> After a short research I found that the IE11 support around 2000 character in
>> the URL. The URL with the AuthRequest has more than 2000 characters.
> I haven't really every seen anything that long. If this isn't Shibboleth, then I would probably suspect that SP is broken in some way.

That does seem a bit large.  I think the obvious initial suspicion is
that the SP might be incorrectly sending via the Redirect binding the
AuthnRequest signed at the XML level rather than using the (required)
binding signature mechanism.  That's the only obvious thing I can think
of. 

Unlikely, but maybe could be some huge number of extensions and/or
extension data (or Conditions, but that seems even less likely).
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161110/bcb238d9/attachment.html>