Danish nemlogin, URL is malformed.

[Bo Lorentsen]

On 27-06-2018 19:18, Cantor, Scott wrote:
> On 6/27/18, 1:05 PM, "Bo Lorentsen" <bl at moch.dk> wrote:
>
>> Now I think I (finally) understand what you meant. The idP returns me
>> the final redirection URL by setting the relayState in the result form
>> (found it in my browser), and the Nemlogin idP sends this in an URL
>> encoding shibboleth don't find valid as it does not expect it to be URL
>> encoded, and does not decode it either.
> No, it's already decoded, it's a parameter in the POST. If that's still encoded after that, then it was doubly-encoded to start with.
Perfect, this is the problem, and also what I found in the log file, it
would have been nice if the log file gave an error along with the error
page.
>
>> I quess this is something I should take up with the idP :-)
> Depends what issued it the request. If the RelayState is wrong in, it will be wrong out.
Before nemlogin change to sha256, this worked fine, in the same setup,
so I guess they have changed a bit more than the signing alg.
>
>> I tried to fix this by using the applicationOverride attribute homeURL,
>> but I can't find a way to force shibboleth to use homeURL over
>> relayState, or have I missed something ?
> If it believes the RelayState is a URL then that's what it's going to assume it should do. You can manipulate what the SP tries to do up front but not if it's not issuing the request to start with.
I am not doing anything special, only what shibboleth is doing as
default (sending the current location url ... I quess).
> I didn't remember that the malformed language was so tightly scoped to that case. I think the message should be clearer given that it's apparently only happening in response to more or less that exact single issue.
That would have been helpful in this case, but on the other hand, this
error type is a bit rare.

I will let you know if the idP relayState encode fix, both is possible
and works, but now i know where to point :)

Anyway, thanks for all your valuable input guys, these kept me sane :-)

/BL