Is a query string parm allowed on SSO endpoint redirect URL?

[Mike Flynn]

Thanks, Scott.  You answered my question with your first response. 

    On Thursday, February 9, 2017 11:45 AM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:
 

 > I have an iDP that has this endpoint in their metadata:

The bindings are explicit about the parameters they permit, so really, no, that's not allowed. I imagine people do it, I don't know exactly what the SP does with it. In your example, you're running into something that's generally viewed as iffy anyway, using POST with a form action containing a query string.

> After authN comes back to my SP, I see this:

I don't understand what I'm looking at, that's not the SP, is it?

> So the question is, why does it drop that parm?  Is this not allowed for an
> endpoint?

I don't understand what is dropping what. Once it reaches the IdP, it's out of the SP's hands and the next SP access is to the AssertionConsumerService at the SP.

-- Scott

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net


   
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170209/6faeb2be/attachment.html>