Hastags in service URL to CAS

[Martin Lunze]

Hi Marvin,

we have a local service provider which heavily uses hashtags (#) in the 
URLs and some of our "gold"-members asked for a user-friendly solution.

So, we decided to "fix" this behaviour on the side of IdP.

The main-problem is that the part of the URL after the # is used as an 
achor in HTML.
It is normally NOT send to the webserver!
The webserver delivers the webpage to the browser and your browser 
parses the page for such a spring-mark and scrolls down to this.

If you are not logged in in the SP, your browser receives a redirect.
At this moment your browser adds the part of the URL after the # to the 
path received by the redirect.
This seems to be the only situation in the shibboleth-flow where the 
part after the # will retained unchanged.

But at the moment you submit the login-form or the user-consent-form the 
part after the # gets lost.
So you have to modify some sites (.vm) of the IdP to ensure the part 
after the # will be retained during the complete login-process.

> - /opt/shibboleth-idp/views/intercept/attribute-release.vm
>     - add javascript to modify "form action - url" [1]
>
> - /opt/shibboleth-idp/views/login.vm
>     - add javascript to modify "form action - url" [1]
>
> - /opt/shibboleth-idp/webapp/WEB-INF/lib/opensaml-saml-impl-3.3.0.jar
>     - templates/saml1-post-binding.vm
>         - add javascript to modify "form action - url" [2]
>
>     - templates/saml2-post-artifact-binding.vm
>         - add javascript to modify "form action - url" [2]
>
>     - templates/saml2-post-binding.vm
>         - add javascript to modify "form action - url" [2]
>
>     - templates/saml2-post-simplesign-binding.vm
>         - add javascript to modify "form action - url" [2]
>
> [1]
> <script type="text/javascript">
> window.onload = function() {
>     var forms = document.getElementsByTagName("form");
>     for(var i=0; i < forms.length; i++) {
>         forms[i].action += window.location.hash;
>     }
> };
> </script>
>
> [2]
> document.forms[0].action+=window.location.hash;

Maybe the little shell script in the attachement helps you to modify all 
necessary files automatically.

After a rebuild of your IdP the original requested URL should stay 
intact with the complete path including the part after the #.
We use this modification in production since version 2.4 of IdP and 
never had a problem, but be aware of that i assume no responsibility.

With nice regards
Martin

On 21.11.2017 14:04, Marvin Addison wrote:
> On Thu, Nov 16, 2017 at 4:04 AM Tobias Galéus <tobias.galeus at gu.se> wrote:
>
>> Yes, I'm aware of the problems with using hashtags in URLs, but how what
>> is the solution to make this work?
>
> I can't think of any reason this shouldn't work, so I'm thinking it's a
> bug. Can you please file an issue and assign to me?
>
> Thanks,
> Marvin <users-unsubscribe at shibboleth.net>
>
>
>

-- 
Martin Lunze
IT-Systemadministrator

Technische Universität Dresden
Zentrum für Informationsdienste und Hochleistungsrechnen (ZIH)
Operative Prozesse und Systeme (OPS)
01062 Dresden

Tel.: +49 (351) 463-35881
E-Mail: martin.lunze at tu-dresden.de

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20171123/d2716092/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: patch-shibboleth-anchors.sh
Type: application/x-shellscript
Size: 798 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20171123/d2716092/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5677 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://shibboleth.net/pipermail/users/attachments/20171123/d2716092/attachment.p7s>