AW: HTTP Redirect Binding and URL Length

[Roehrl Patrick]

Yeah the XML contains also the signature information (SignatureValue, SignedInfo, KeyInfo) and that makes it so big. And the request contains also the signature as parameter...so seems like a signature too much.
So our SP uses the wrong binding for Redirect.
POST Binding --> embedded signature in XML
Redirect Binding --> signature as request parameter
This would be correct?

Von: users [mailto:users-bounces at shibboleth.net] Im Auftrag von Brent Putman
Gesendet: Donnerstag, 10. November 2016 17:43
An: users at shibboleth.net
Betreff: Re: HTTP Redirect Binding and URL Length


On 11/10/16 10:42 AM, Cantor, Scott wrote:

After a short research I found that the IE11 support around 2000 character in

the URL. The URL with the AuthRequest has more than 2000 characters.



I haven't really every seen anything that long. If this isn't Shibboleth, then I would probably suspect that SP is broken in some way.

That does seem a bit large.  I think the obvious initial suspicion is that the SP might be incorrectly sending via the Redirect binding the AuthnRequest signed at the XML level rather than using the (required) binding signature mechanism.  That's the only obvious thing I can think of.

Unlikely, but maybe could be some huge number of extensions and/or extension data (or Conditions, but that seems even less likely).
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161111/b393af1f/attachment.html>