Shibboleth SSO server adds "=" after query string

Mon Jan 8 06:30:49 EST 2018

Hi Rob,

There is no "=" character in the url that is sent to the Shib server.  I
have listed the complete http request/reponse that is taking place to avoid
any confusion in understanding the issue. Please take some time to go
through these transactions as we really feel that this is an issue that
needs to be analyzed at shibboleth server. Thanks a ton in advance for
taking out time in going through these huge http requests

*Request 1:*
https://shib.example.edu/sso/module.php/casserver//login.php?service=https%3a%2f%2flibrary.example.edu%2fpatroninfo~S7%3f%2f0%2fredirect%3dhttps%3a%2f%2flibrary.example.edu%3a443%2fsearch~S7%3f%2fpblackwell%2fpblackwell%2f1,1,2,B%2fl962~1070705%26FF%3dpblackwell%2bpamela%261,,2,0,0

*user gets redirected to: First redirection*

https://shib.example.edu/sso/saml2/idp/SSOService.php?SAMLRequest=hVJda8IwFP0rJe81bV3VBRWcMia4KdbtYS8jTW410CZdbrqPf7+0deBeHAQC595zzr0nmSKvypotGnfSe3hvAF3wVZUaWVeYkcZqZjgqZJpXgMwJli0eNywZRKy2xhlhSnJBuc7giGCdMpoE69WMvMnhKBnKNI0jOYJ0zNM4Hd/mEz6WRZEIMYHRMBnx4jaRJHgBi545I17I0xEbWGt0XDsPRfEkjOIwmhzimLXn5pUEK7+N0tx1rJNzNTJK8aTyAbdOgHZgByAbimhoO3tClaxplm0zsB9KwKA+1SRY/M68NBqbCuy5+rzf/KtaGdmUnU5nQLG/k5AL7FDBMbdKHiFEb7U7B3qntFT6eD3LvG9C9nA47MLdNjuQ+bRVZ102du61w158Si/xaf/mT15xvdqZUonv4N7Yirvrhi2iZFh0rcxZrlH5dX1CZWk+lxa4gxlxtgFC573l3581/wE=&RelayState=https://shib.example.edu/sso/module.php/casserver//login.php?service=https%3A%2F%2Flibrary.example.edu%2Fpatroninfo%7ES7%3F%2F0%2Fredirect%3Dhttps%3A%2F%2Flibrary.example.edu%3A443%2Fsearch%7ES7%3F%2Fpblackwell%2Fpblackwell%2F1%2C1%2C2%2CB%2Fl962%7E1070705%26FF%3Dpblackwell%2Bpamela%261%2C%2C2%2C0%2C0

*with Query strings:*
<i>SAMLRequest</i>
hVJda8IwFP0rJe81bV3VBRWcMia4KdbtYS8jTW410CZdbrqPf7+0deBeHAQC595zzr0nmSKvypotGnfSe3hvAF3wVZUaWVeYkcZqZjgqZJpXgMwJli0eNywZRKy2xhlhSnJBuc7giGCdMpoE69WMvMnhKBnKNI0jOYJ0zNM4Hd/mEz6WRZEIMYHRMBnx4jaRJHgBi545I17I0xEbWGt0XDsPRfEkjOIwmhzimLXn5pUEK7+N0tx1rJNzNTJK8aTyAbdOgHZgByAbimhoO3tClaxplm0zsB9KwKA+1SRY/M68NBqbCuy5+rzf/KtaGdmUnU5nQLG/k5AL7FDBMbdKHiFEb7U7B3qntFT6eD3LvG9C9nA47MLdNjuQ+bRVZ102du61w158Si/xaf/mT15xvdqZUonv4N7Yirvrhi2iZFh0rcxZrlH5dX1CZWk+lxa4gxlxtgFC573l3581/wE=
<i>RelayState</i>
https://shib.example.edu/sso/module.php/casserver//login.php?service=https%3A%2F%2Flibrary.example.edu%2Fpatroninfo%7ES7%3F%2F0%2Fredirect%3Dhttps%3A%2F%2Flibrary.example.edu%3A443%2Fsearch%7ES7%3F%2Fpblackwell%2Fpblackwell%2F1%2C1%2C2%2CB%2Fl962%7E1070705%26FF%3Dpblackwell%2Bpamela%261%2C%2C2%2C0%2C0

*Again redirects to : Second redirection*

https://shib.example.edu/sso/module.php/core/loginuserpass.php?AuthState=_66dc8e69b316628a3d8254c62605afb99d02cccfb2:https://shib.example.edu/sso/saml2/idp/SSOService.php?spentityid=cas-bridge&cookieTime=1515409874&RelayState=https%3A%2F%2Fshib.example.edu%2Fsso%2Fmodule.php%2Fcasserver%2F%2Flogin.php%3Fservice%3Dhttps%253A%252F%252Flibrary.example.edu%252Fpatroninfo%257ES7%253F%252F0%252Fredirect%253Dhttps%253A%252F%252Flibrary.example.edu%253A443%252Fsearch%257ES7%253F%252Fpblackwell%252Fpblackwell%252F1%252C1%252C2%252CB%252Fl962%257E1070705%2526FF%253Dpblackwell%252Bpamela%25261%252C%252C2%252C0%252C0

*Query String:*
<i>AuthState</i>
_66dc8e69b316628a3d8254c62605afb99d02cccfb2:
https://shib.example.edu/sso/saml2/idp/SSOService.php?spentityid=cas-bridge&cookieTime=1515409874&RelayState=https%3A%2F%2Fshib.example.edu%2Fsso%2Fmodule.php%2Fcasserver%2F%2Flogin.php%3Fservice%3Dhttps%253A%252F%252Flibrary.example.edu%252Fpatroninfo%257ES7%253F%252F0%252Fredirect%253Dhttps%253A%252F%252Flibrary.example.edu%253A443%252Fsearch%257ES7%253F%252Fpblackwell%252Fpblackwell%252F1%252C1%252C2%252CB%252Fl962%257E1070705%2526FF%253Dpblackwell%252Bpamela%25261%252C%252C2%252C0%252C0

<b>After login button is clicked:</b>

https://shib.example.edu/sso/module.php/saml/sp/saml2-acs.php/casbridge-sp

Query Strings:
SAMLResponse
PHNhbWxwOlJlc3BvbnNlIHhtbG5zOnNhbWxwPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6cHJvdG9jb2wiIHhtbG5zOnNhbWw9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphc3NlcnRpb24iIElEPSJfODNkNjA5ZmNhMzY2ODFjNjFiNjI1ODVlOTJiZmM5ZDY4MzE3YTljZDM3IiBWZXJzaW9uPSIyLjAiIElzc3VlSW5zdGFudD0iMjAxOC0wMS0wOFQxMToxNzoyMFoiIERlc3RpbmF0aW9uPSJodHRwczovL3NoaWIuYXJ0Y2VudGVyLmVkdS9zc28vbW9kdWxlLnBocC9zYW1sL3NwL3NhbWwyLWFjcy5waHAvY2FzYnJpZGdlLXNwIiBJblJlc3BvbnNlVG89Il9kMzYyM2Q1NTEwZDZlNTdhNTE1NzliOGE3ZGZmMmNjOGU2MzI2YWY5MmQiPjxzYW1sOklzc3Vlcj5odHRw…XJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmF0dHJuYW1lLWZvcm1hdDpiYXNpYyI+PHNhbWw6QXR0cmlidXRlVmFsdWUgeHNpOnR5cGU9InhzOnN0cmluZyI+U3R1QWN0djwvc2FtbDpBdHRyaWJ1dGVWYWx1ZT48L3NhbWw6QXR0cmlidXRlPjxzYW1sOkF0dHJpYnV0ZSBOYW1lPSJhY2NkUm9sZXMiIE5hbWVGb3JtYXQ9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphdHRybmFtZS1mb3JtYXQ6YmFzaWMiPjxzYW1sOkF0dHJpYnV0ZVZhbHVlIHhzaTp0eXBlPSJ4czpzdHJpbmciPlN0dUFjdHY8L3NhbWw6QXR0cmlidXRlVmFsdWU+PC9zYW1sOkF0dHJpYnV0ZT48L3NhbWw6QXR0cmlidXRlU3RhdGVtZW50Pjwvc2FtbDpBc3NlcnRpb24+PC9zYW1scDpSZXNwb25zZT4=

RelayState
https://shib.example.edu/sso/module.php/casserver//login.php?service=https%3A%2F%2Flibrary.example.edu%2Fpatroninfo%7ES7%3F%2F0%2Fredirect%3Dhttps%3A%2F%2Flibrary.example.edu%3A443%2Fsearch%7ES7%3F%2Fpblackwell%2Fpblackwell%2F1%2C1%2C2%2CB%2Fl962%7E1070705%26FF%3Dpblackwell%2Bpamela%261%2C%2C2%2C0%2C0

*Redirected to: First Redirection*

https://shib.example.edu/sso/module.php/casserver//login.php?service=https://library.example.edu/patroninfo~S7?/0/redirect=https://library.example.edu:443/search~S7?/pblackwell/pblackwell/1,1,2,B/l962~1070705&FF=pblackwell+pamela&1,,2,0,0

*Query string:*
service:
https://library.example.edu/patroninfo~S7?/0/redirect=https://library.example.edu:443/search~S7?/pblackwell/pblackwell/1,1,2,B/l962~1070705&FF=pblackwell+pamela&1,,2,0,0

*Redirects to: Second Redirection*
https://library.example.edu/patroninfo~S7?/0/redirect=https://library.example.edu:443/search~S7?/pblackwell/pblackwell/1,1,2,B/l962~1070705&FF=pblackwell+pamela&1,,2,0,0=&ticket=ST-eb2fea4fc30c1b0026db28e25be2435789c2697859

*Query String:*
/0/redirect :
https://library.example.edu:443/search~S7?/pblackwell/pblackwell/1,1,2,B/l962~1070705
FF : pblackwell+pamela
1,,2,0,0:
ticket: ST-eb2fea4fc30c1b0026db28e25be2435789c2697859

Here the parameter in the url "1,,2,0,0" is changed into key -value. That
is why in the querystring section also it is placed as a key.
Upto this point no where is it mentioned that "1,,2,0,0" should be treated
as Key-value. The input sent to the shib server does not mention it as
key-value.

Even if the "=" is to be changed to url ecoding thent  he value shoule be
%3d.

So I am not sure why there would be an "=" urlencoding. Also , the url
encoding for = is %3d. So "=" in an url should be changed to %3d .

On Mon, Jan 8, 2018 at 4:26 PM, Rod Widdowson <rdw at steadingsoftware.com>
wrote:

> > The additional = highlighted here is causing the error.
>
> That’s URL encoding.
>
> --
> For Consortium Member technical support, see https://wiki.shibboleth.net/
> confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net

-- 

Regards,
Virajitha
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180108/aa32cdcc/attachment-0001.html>