idp RemoteUser url-parameters jsession occasional-login-failures

[Rainer Hoerbe]

> Am 07.10.2016 um 19:37 schrieb Jim Fox <fox at washington.edu>:
> 
> 
> (Possibly everyone knew this but me.)
> 
> I thought an https URL was basically like:
> 
>   https://host[:port]/path[?query_string]
> 
> but it's really like:
> 
>   https://host[:port]/path[;parameters][?query_string]
> 
> Those parameters were causing login failures.

Just for the record: RFC 3986 says:
"The query component is indicated by the first question mark ("?") character and terminated by a number sign ("#") character or by the end of the URI.“

Therefore the key-value pair in "[;parameters]“ is illegal.

Implementations might process the semicolon as starting the query string, because it is not a "unreserved character" that may appear in the path. However, clients issuing those URLs should be flagged as misbehaving.

- Rainer