Danish nemlogin, URL is malformed.

[Cantor, Scott]

On 6/27/18, 1:05 PM, "Bo Lorentsen" <bl at moch.dk> wrote:

> Now I think I (finally) understand what you meant. The idP returns me
> the final redirection URL by setting the relayState in the result form
> (found it in my browser), and the Nemlogin idP sends this in an URL
> encoding shibboleth don't find valid as it does not expect it to be URL
> encoded, and does not decode it either.

No, it's already decoded, it's a parameter in the POST. If that's still encoded after that, then it was doubly-encoded to start with.

> I quess this is something I should take up with the idP :-)

Depends what issued it the request. If the RelayState is wrong in, it will be wrong out.

> I tried to fix this by using the applicationOverride attribute homeURL,
> but I can't find a way to force shibboleth to use homeURL over
> relayState, or have I missed something ?

If it believes the RelayState is a URL then that's what it's going to assume it should do. You can manipulate what the SP tries to do up front but not if it's not issuing the request to start with.

I didn't remember that the malformed language was so tightly scoped to that case. I think the message should be clearer given that it's apparently only happening in response to more or less that exact single issue.

-- Scott