Hyperlinks to Shibboleth protected URLs in MS Office documents

Thu Nov 23 04:08:27 EST 2017

Hi

this old problem [1] has come up again...

We used to circumvent this behaviour of MS Office by using 
urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST as the outgoing binding 
from SP to IdP. We described the problem at 
https://admin.kuleuven.be/icts/services/aai/documentation/sp/linksfromofficetosp.html 

The behaviour used to be that if that internal ms-office browser saw an 
HTTP 200 response, it would open the default browser and reissue that 
request.

Now we observe that the internal browser goes one step further... please 
bear with me

Requests we see when I click on a hyperlink of a 
with-shibboleth-protected-resource:

Request #1 - using internal ms-office browser:
HEAD https://domain.com/protected_resource HTTP/1.1
User-Agent: Microsoft Office Word 2014 (16.0.4549) Windows NT 10.0

HTTP/1.1 200 OK
Content-Type: text/html

Request #2 - using internal ms-office browser:
GET https://domain.com/protected_resource HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; 
Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; 
.NET CLR 3.5.30729; ms-office)

HTTP/1.1 200 OK
Content-Type: text/html

[..]
<html>
     <head>
         <title>Shibboleth Authentication Request</title>
     </head>
     <body onload="document.forms[0].submit()">

         <h1>Shibboleth Authentication Request</h1>

[..]
         <form method="POST" 
action="https://idp.domain.com/idp/profile/SAML2/POST/SSO">
             <input type="hidden" name="RelayState" value="[..]"/>
             <input type="hidden" name="SAMLRequest" value="[..]"/>

[..]

Request #3 - using my default browser in a 2nd tab:
GET https://domain.com/protected_resource HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 
(KHTML, like Gecko) Chrome/62.0.3202.62 Safari/537.36

-> this tab is handled correctly. The browser POSTs the SAMLRequest & 
Relaystate to the endpoint of the IdP.

Request #4 - using my default browser in the first tab:
GET https://idp.domain.com/idp/profile/SAML2/POST/SSO HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 
(KHTML, like Gecko) Chrome/62.0.3202.62 Safari/537.36

HTTP/1.1 400 Bad Request

-> Because the Shibboleth IdP is expecting a POST instead of a GET. So 
it seems like that internal browser of MS goes one step further. It 
extracts the form action URL, then opens the default browser and 
launches a GET ?! to that URL.

So after clicking on that hyperlink the users gets two tabs in its 
default browser. The first one with an error, the other one without.

I am aware of a possible client side solution using a registry key, but 
I am looking for a way to solve this server side.

Kind regards,

Philip

[1] 
http://shibboleth.1660669.n2.nabble.com/Office-Hyperlinks-amp-Shib-cookie-errors-td5748609.html