Recent Safari update breaks some SPs ?

[Losen, Stephen C. (scl)]

Hi folks,

Anyone running into problems with recently updated Safari on MacOS?  My supervisor updated his Mac and now at least one SP has stopped working (Service Now).  In idp-process.log I see these errors:

2016-10-25 08:02:02,089 - WARN [org.opensaml.saml.common.binding.security.impl.BaseSAMLSimpleSignatureSecurityHandler:275] - Message Handler:  Simple signature validation (with no request-derived credentials) failed
2016-10-25 08:02:02,089 - WARN [org.opensaml.saml.common.binding.security.impl.BaseSAMLSimpleSignatureSecurityHandler:212] - Message Handler:  Validation of request simple signature failed for context issuer: https://uvaprod.service-now.com

This SP still works fine for other browsers and the updated Safari works with at least one other SP.

I can see from the httpd logs that Safari is doing

GET /idp/profile/SAML2/Redirect/SSO?SAMLRequest= ...

And in the query string is &RelayState= ...  In the requests that fail, the URL begins with https://... while in requests that work properly the URL is encoded with https%3A%2F%2F...

So it looks like Safari is decoding part of the query string that it should be leaving alone.

Anyone know what's up with this Safari update?

Stephen C. Losen
ITS - Systems and Storage
University of Virginia
scl at virginia.edu    434-924-0640