Danish nemlogin, URL is malformed.

[Bo Lorentsen]

On 06/27/2018 05:01 PM, Cantor, Scott wrote:
> On 6/27/18, 10:53 AM, "users on behalf of Bo Lorentsen" <users-bounces at shibboleth.net on behalf of bl at moch.dk> wrote:
>
>> I hope this is attribute mapping related, but I really cant tell.
> It's not. The "malformed" language appears when it's sanitizing a URL and doesn’t find a colon in it at a point that one has to appear. It's probably an IdP not performing correct URL encoding somewhere or an application not doing it in the first place.
Now I think I (finally) understand what you meant. The idP returns me
the final redirection URL by setting the relayState in the result form
(found it in my browser), and the Nemlogin idP sends this in an URL
encoding shibboleth don't find valid as it does not expect it to be URL
encoded, and does not decode it either.

I can now verify this, by making an AuthRequest that result in the above
error, if i then reenter the original sso url (where the nginx auth
handler resides) the CGI on that location are then authorized and I log
in as expected.

I quess this is something I should take up with the idP :-)

I tried to fix this by using the applicationOverride attribute homeURL,
but I can't find a way to force shibboleth to use homeURL over
relayState, or have I missed something ?

/BL
>
> -- Scott
>
>