Recent Safari update breaks some SPs ?

[Losen, Stephen C. (scl)]

Hi folks,

Safari is definitely converting %3A to : and %2F to / in the URL query string.  My colleague installed the MacOS and Safari update and used the tracing tool in Safari.  The response from the Service Now SP (the redirect URL) has %3A and %2F and the subsequent request to the IDP has : and / instead. So Safari definitely modifies the redirect URL and this prevents the IDP from verifying the signature.

Looking back a few days in our IDP httpd logs I see no requests pertaining to Service Now that have : and / until yesterday, so this behavior is recent.

You might want to notify your help desk.

In case anyone cares, here is a sample IDP request with literal / and : in the query string and which fails the signature check.

GET /idp/profile/SAML2/Redirect/SSO?SAMLRequest=nVNNj9owEP0rke84sSEgLECioKpI211E2B56M/EELCV26nHC9t/XCezCoaVqD7l4Zt68j8kMZVXyWiwbfzI7%2BNEA%2BuitKg2KS2VOGmeElahRGFkBCp%2BLbPn1SXCaiNpZb3NbkmiJCM5ra1bWYFOBy8C1OofX3dOcnLyvUcRx08owoSheagNjzzS3VWxkW8sjUGVJtA4MtJEd1G0QT/qgVU21R9pqd9RGSwqqicNjHCALXULcseLxDpR2kPs4y15I9Nm6HHpxc1LIEoFEm/WcZM%2BrZHpgrEjTZDopJBunk4SDZPJwmKbpZDIuQiNuJaJu4TaK2MDGoJfGzwlP2HjAkgFP94wLPhRsREd88p1E26stn7RR2hwfe3i4NKH4st9vB9uXbN8DtFqBew7d/2bfN3DYWxegyWLWhyh63u4%2B18eU5HuYZPGX3bP4fsN1Xy063pv11pY6/xkty9KeVw6kD1q8a6CPpZL%2BSkIrkdAp5cMRp2zKk2SYJJR1H2Uk/sC8XieoPs5wZh7efLSyVS2dxk4yvMncf4i%2Bb1uVQdIOiv%2By4GFbLvIOOzx3x3K2TnXhh/sDtXfSYG2dfzfpd4wW1%2BIf9N3K93/o4hc%3D&RelayState=https://uvaprod.service-now.com/navpage.do&SigAlg=http://www.w3.org/2000/09/xmldsig%23rsa-sha1&Signature=pjlC0tJO2dJEFZ5Dt7/G3lwm9acE675VOpVTJYwpBEIWENdcWCM%2BAVMU5JR2OxEs%2B3Wfj1FP9WN7lWWbYUdRSsAAMwJxDJ0f8Rnuxyak/jUsXHjdIoFoD3mMsY8rrVz34op3cS0IlGUHBZnEtgr8FI73xTLfwL3Jpo1qub9Zq/U%3D

Stephen C. Losen
ITS - Systems and Storage
University of Virginia
scl at virginia.edu    434-924-0640

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Losen, Stephen C. (scl)
Sent: Tuesday, October 25, 2016 5:16 PM
To: Shib Users
Subject: RE: Recent Safari update breaks some SPs ?

Hi,

I am blaming Safari because 1) my supervisor had no trouble with Safari yesterday, but it broke today after he ran the MacOS update.  2) When we use other browsers to connect to the Service Now SP we can see in the IDP httpd logs very similar GET requests, except that the Safari requests that fail have https:// instead of https%3A%2F%2F.

And now looking closer, I see that the entire query string from Safari has literal /s instead of %2F and literal : instead of %3A.

To see if Safari is indeed changing the query string we'll need to trace the session on Safari.

I was just hoping that others have seen this problem and know the reason, since I'm not particularly motivated to debug Safari.

Stephen C. Losen
ITS - Systems and Storage
University of Virginia
scl at virginia.edu    434-924-0640

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Tuesday, October 25, 2016 4:23 PM
To: Shib Users
Subject: RE: Recent Safari update breaks some SPs ?

> And in the query string is &RelayState= ...  In the requests that fail, the URL
> begins with https://... while in requests that work properly the URL is
> encoded with https%3A%2F%2F...
> 
> So it looks like Safari is decoding part of the query string that it should be
> leaving alone.

That seems pretty eggregious to be a Safari bug. Are you sure the issue isn't with the source system producing the redirect? That particular source system isn't known for robustness.

-- Scott

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net