potential entityID bug in IdP 3.2.1

[Liam Hoekenga]

We recently had a problem where one of our SPs entityID's contained
trailing spaces, but the metadata we had on the IdP did not.  So we got a
request that looked like...

<samlp:AuthnRequest
    Destination="https://shibboleth.umich.edu/idp/profile/SAML2/POST/SSO"
    ID="_afcc608c-a09d-423f-afe8-e6fac36c6b69"
    IssueInstant="2016-09-27T20:33:04Z"
    ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
    Version="2.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
    <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
https://service.example.umich.edu/  </saml:Issuer>
...
</samlp:AuthnRequest>

but our response was for "https://service.example.umich.edu/".
Unsurprisingly, their SP did not like receiving a response for the wrong
entityID, and we had a merry little POST fest.

Shouldn't the IdP have denied the entityID with the trailing spaces?  We
didn't have metadata that matched that entityID.

Liam

ps - I have since read the entityID naming recommendations that recommend
against putting trailing slashes on URL-style entityIDs.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160928/6d53352c/attachment-0001.html>