idp RemoteUser url-parameters jsession occasional-login-failures

[Jim Fox]

(Possibly everyone knew this but me.)

I thought an https URL was basically like:

    https://host[:port]/path[?query_string]

but it's really like:

    https://host[:port]/path[;parameters][?query_string]

Those parameters were causing login failures.


We front the IdP with Apache and are using the RemoteUser flow, which redirects to /idp/Authn/UWLogin for the authn.

We get occasional hits that look like:

   GET /idp/profile/SAML2/POST/SSO;jsessionid=...

and that's OK, but some clients (I think it's the clients) gratuitously add that parameter to the next redirect, so it is:

   GET /idp/Authn/UWLogin;jsessionid=...?conversation=e1s1

The problem is that Apache considers the parameter to be part of the path, so our

<Location /idp/Authn/UWLogin>
  some config that's logs the user in
</Location>

does not trigger. Instead it goes directly to the next idp step -- without a remote_user set.

Fixing the authn to

<LocationMatch /idp/Authn/UWLogin($|;)>
  some config that's logs the user in
</LocationMatch>

fixed the problem.

Jim