Shibboleth SP3 Problem: xmltooling::IOException setHeader (Header) failed: -2147024809

[Stephen Holland-Chang]

Thanks everyone for your help! We ended up just removing the <streetaddress> from attribute-map.xml as we do not even use it. That resolved the issue. Also, will holdout this encoding information in the future if we have a problem. Just for my own sanity, the IDP is NOT supposed to be sending those characters through the SAML2 POST right? 

Stephen

> On Jan 27, 2021, at 3:47 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> 
> Oh, there is one other way which I totally forgot existed, but this sort of thing is why it was added.
> 
> You can set an encoding="URL" property inside the RequestMap to cause it to URL-encode the data when it's placed into the headers. That is of course everything, not just one attribute or one value situation, so the app has to turn around and decode the data.
> 
> So it's probably overkill, but it does exist.
> 
> https://wiki.shibboleth.net/confluence/display/SP3/RequestMap
> 
> -- Scott
> 
> On 1/27/21, 5:31 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:
> 
>    On 1/27/21, 3:46 PM, "users on behalf of Stephen Holland-Chang" <users-bounces at shibboleth.net on behalf of stephen at attendeenet.com> wrote:
> 
>>   Does that ring any bells?
> 
>    Are you asking if that would be likely to break? Yes. There is zero chance of that working. A header can't cross lines, and IIS is just flagging an obvious problem.
> 
>> IDP is sending the linebreaks, can shibboleth be set to ignore those or filter them before hitting IIS?
> 
>    I'm not sure anybody would expect an IdP to supply an address and I wouldn't bother to even map it, but it should be possible with the AttributeFilter layer to regex match on the offending character and use that to trigger dropping it on the floor.
> 
>    https://wiki.shibboleth.net/confluence/display/SP3/XMLAttributeFilter
> 
>    -- Scott
> 
> 
> 
> -- 
> For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net