Recent Safari update breaks some SPs ?

[John C. Pfeifer]

We are experiencing this problem with Safari/ServiceNow as well.

> On Oct 25, 2016, at 4:05 PM, Losen, Stephen C. (scl) <scl at eservices.virginia.edu> wrote:
> 
> Hi folks,
> 
> Anyone running into problems with recently updated Safari on MacOS?  My supervisor updated his Mac and now at least one SP has stopped working (Service Now).  In idp-process.log I see these errors:
> 
> 2016-10-25 08:02:02,089 - WARN [org.opensaml.saml.common.binding.security.impl.BaseSAMLSimpleSignatureSecurityHandler:275] - Message Handler:  Simple signature validation (with no request-derived credentials) failed
> 2016-10-25 08:02:02,089 - WARN [org.opensaml.saml.common.binding.security.impl.BaseSAMLSimpleSignatureSecurityHandler:212] - Message Handler:  Validation of request simple signature failed for context issuer: https://uvaprod.service-now.com
> 
> This SP still works fine for other browsers and the updated Safari works with at least one other SP.
> 
> I can see from the httpd logs that Safari is doing
> 
> GET /idp/profile/SAML2/Redirect/SSO?SAMLRequest= ...
> 
> And in the query string is &RelayState= ...  In the requests that fail, the URL begins with https://... while in requests that work properly the URL is encoded with https%3A%2F%2F...
> 
> So it looks like Safari is decoding part of the query string that it should be leaving alone.
> 
> Anyone know what's up with this Safari update?
> 
> Stephen C. Losen
> ITS - Systems and Storage
> University of Virginia
> scl at virginia.edu    434-924-0640
> 
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net


//
John Pfeifer
Division of Information Technology
University of Maryland, College Park