missing URL-encoding in audit log

Andrew Morgan morgan at orst.edu
Mon Jul 24 18:23:19 EDT 2017


I noticed that my log analysis script has been failing some days, and I 
tracked it down to an extra pipe ("|") included in the log entry. 
Apparently it is leaking into the audit log in the CAS service URL.  Here 
is a log entry that has it:

20170723T210835Z|||https://courses.ecampus.oregonstate.edu/fishes-collection/image.php?id=1038|isIframe|https://www.apereo.org/cas/protocol/serviceValidate||||johnsohe||commonName,firstname,osuprimarymail,eduPersonAffiliation,osupidm,givenName,osuuid,lastname,uid,eduPersonPrimaryAffiliation,UDC_IDENTIFIER,surname,eduPersonPrincipalName,fullname,email|redacted|ST-1500844114970-gexyXcF2ZtqyoDEefZxbmpnfA|

Note the "|isIframe" that came in on the service URL.

Here is the idp-process.log for it:

2017-07-23 14:08:35,543 - WARN [net.shibboleth.idp.cas.service.impl.DefaultServiceComparator:86] - Error parsing https://courses.ecampus.oregonstate.edu/fishes-collection/image.php?id=1038|isIframe
2017-07-23 14:08:35,543 - WARN [net.shibboleth.idp.cas.service.impl.DefaultServiceComparator:86] - Error parsing https://courses.ecampus.oregonstate.edu/fishes-collection/image.php?id=1038|isIframe
2017-07-23 14:08:35,544 - INFO [net.shibboleth.idp.cas.flow.impl.ValidateTicketAction:117] - Successfully validated ST-1500844114970-gexyXcF2ZtqyoDEefZxbmpnfA for https://courses.ecampus.oregonstate.edu/fishes-collection/image.php?id=1038|isIframe
2017-07-23 14:08:35,605 - INFO [Shibboleth-Audit.SSO:241] - 20170723T210835Z|||https://courses.ecampus.oregonstate.edu/fishes-collection/image.php?id=1038|isIframe|https://www.apereo.org/cas/protocol/serviceValidate||||johnsohe||commonName,firstname,osuprimarymail,eduPersonAffiliation,osupidm,givenName,osuuid,lastname,uid,eduPersonPrimaryAffiliation,UDC_IDENTIFIER,surname,eduPersonPrincipalName,fullname,email|redacted|ST-1500844114970-gexyXcF2ZtqyoDEefZxbmpnfA|

I didn't find an open bug for this.  Should the IDP be escaping the pipe 
symbol somehow?

Thanks,
 	Andy


More information about the users mailing list