SP- Redirect to improper urls after setting value for redirectErrors

[Alexander Ivanov]

> If it redirects an error, there would be specific parameters on the URL
that I'm not seeing there.

What specific parameters on the URL would there be on an error redirect?

This problem occurs during a failed passive login attempt.  It is occurring
for both of our applications, so I think the SP must be at fault.  Both of
our applications make passive login calls to Shibboleth IdP when an
anonymous user first navigates to the site.  After a successful login, if
the browser is closed and re-opened and the user navigates to the site
again, the error occurs.  Before I configured the redirectErrors paths in
the config file the SAML error was being displayed to the user:

opensaml::FatalProfileException
The system encountered an error at Tue Nov 29 09:28:32 2016
To report this problem, please contact the site administrator at
root at localhost.
Please include the following message in any email:
opensaml::FatalProfileException at (
https://stage.qdr.org/Shibboleth.sso/SAML2/POST)
SAML response contained an error.
Error from identity provider:
    Status: urn:oasis:names:tc:SAML:2.0:status:Requester
    Sub-Status: urn:oasis:names:tc:SAML:2.0:status:NoPassive
    Message: An error occurred.



On Mon, Jan 23, 2017 at 9:49 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> > I did not get a chance to say that when an error redirect is triggered,
> the user is sent to an improper url such as this:
> > https://stage.qdr.org/adaptive_image=1920;%20has_js=
> 1;%20_check_is_passive=
>
> If it redirects an error, there would be specific parameters on the URL
> that I'm not seeing there.
>
> > The text appended to the url seems to be from the browser's cookie
> file.  It's interesting to note that this error seems to
> > only occur with Firefox, and in Firefox all cookies are stored in a
> single file according to the Mozilla documentation.  It looks
> > like the SP is tacking the contents of the user's cookie file to the
> redirectErrors url
>
> It does not.
>
> > Has anyone else encountered this issue?
>
> No. I don't test that feature often, I can try a quick test with Firefox
> with an SP on Windows if a bug is filed, but honestly, no, I don't think
> the SP is doing this. Unless you're leaving off stuff from the URL perhaps
> that would better match what the SP includes when it does the redirects.
>
> -- Scott
>
>
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170123/845e0755/attachment.html>