missing URL-encoding in audit log

[Cantor, Scott]

Again, I'm not saying there's not a problem. You could use 'A' as a delimeter for all the IdP would know about it, and obviously that's going to show up in URLs.

Since SAML entityIDs tend to be clean to log and CAS locations may not be, it would be reasonable to add in an encoding step to the CAS field mapping, and in fact that can be done by a deployer.

I'm just trying to explain that pipes oughtn't appear in a decoded URL to begin with so there is an underlying bug on the other end causing the need for defensiveness in the logging that will also in turn be really annoying when you have to look at all the perfectly safe URLs being encoded with percent signs all over them and making it harder to scan them quickly, all because somebody can't be bothered to encode their parameters properly.

-- Scott