Shibboleth SP - Query Parameter is lost after login

[Giorgio Visentin]

Hi,

for one of our customers we are using Shibboleth SP (ver.3.3.0) installed on Apache Web Server (ver. 2.4.51) on many of its web applications.

All web applications are Single Page Application  (SPA) developed with Angular.

We have a problem with only one of this web applications, which reads a parameter from the url after the authentication process is completed.

Example :
Open  a web browser on https://example.com/snoop/#/about?invitationCode=1234567 <https://example.com/snoop/#/about?invitationCode=1234567>
we are redirect to the IDP (ADFS)
I enter the credential and I’m authenticated
But the final landing page is https://example.com/snoop/ <https://example.com/snoop/> and not the original (https://example.com/snoop/#/about?invitationCode=12345678 <https://example.com/snoop/#/about?invitationCode=12345678>)

When I don't append query parameters (example : https://example.com/snoop/#/about <https://example.com/snoop/#/about>  or  https://example.com/snoop/#/page1 <https://example.com/snoop/#/page1> everything works.

Why “?invitationCode= <https://example.come/snoop/#/about?invitationCode=24061026>12345678”  is lost ?  My configurations are : 

Virtual Host
——————————————————————————————
<VirtualHost *:443>
   …..

    ServerName https://example.com/ <https://example.come/snoop/#/about?invitationCode=24061026>

    RequestHeader set X-Session-Id %{Shib-Session-ID}s
    RequestHeader set X-User-Id %{REMOTE_USER}s

    <Location />
        ProxyPreserveHost On
        ProxyPass http://<my_back_end_server_url>:8080/ timeout=120
        ProxyPassReverse http://<my_back_end_server_url>:8080/
        AuthType shibboleth
        ShibRequireSession On
        ShibUseHeaders On
        require shibboleth
    </Location>

</VirtualHost>


File : shibd.conf
——————————————————————————————

LoadModule mod_shib /usr/lib64/shibboleth/mod_shib_24.so

ShibCompatValidUser Off

<Location /Shibboleth.sso>
   AuthType None
   Require all granted
</Location>

<IfModule mod_alias.c>
    <Location /shibboleth-sp>
        AuthType None
        Require all granted
    </Location>
    Alias /shibboleth-sp/main.css /usr/share/shibboleth/main.css
</IfModule>

File shibboleth2.xml
——————————————————————————————

<SPConfig xmlns="urn:mace:shibboleth:3.0:native:sp:config"
          xmlns:conf="urn:mace:shibboleth:3.0:native:sp:config"
          clockSkew="180">

    <OutOfProcess tranLogFormat="%u|%s|%IDP|%i|%ac|%t|%attr|%n|%b|%E|%S|%SS|%L|%UA|%a" />
    <RequestMapper type="Native">
        <RequestMap>
            <Host scheme="https" name="example.com" applicationId="example"/>
        </RequestMap>
    </RequestMapper>

    <ApplicationDefaults entityID="https://example.com/Shibboleth.sso"
                         REMOTE_USER="SHIBBO_NAME_ID" signing="true"
                         cipherSuites="DEFAULT:!EXP:!LOW:!aNULL:!eNULL:!DES:!IDEA:!SEED:!RC4:!3DES:!kRSA:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1">

        <Sessions lifetime="28800" timeout="3600" relayState="ss:mem" redirectLimit="exact" maxTimeSinceAuthn="3500"
                  checkAddress="false" handlerSSL="true" cookieProps="; path=/; secure; HttpOnly">

            <SSO entityID="http://sts.myplatform.com/adfs/services/trust" forceAuthn="true">
                SAML2 SAML1
            </SSO>
            <Logout asynchronous="false">SAML2 Local</Logout>
            <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>
            <Handler type="Status" Location="/Status"/>
            <Handler type="Session" Location="/Session" showAttributeValues="false"/>
            <Handler type="DiscoveryFeed" Location="/DiscoFeed"/>

        </Sessions>

        <MetadataProvider type="XML" path="/etc/shibboleth/FederationMetadata.xml"/>

        <AttributeExtractor type="XML" validate="true" reloadChanges="true" path="attribute-map.xml"/>
        <AttributeResolver type="Query" subjectMatch="true"/>
        <AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>
        <CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/>
       
    <ApplicationOverride id="example" entityID="https://example.com/Shibboleth.sso" homeURL="https://example.com/">
            <CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/>
        </ApplicationOverride>

    </ApplicationDefaults>

    <SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/>
    <ProtocolProvider type="XML" validate="true" reloadChanges="true" path="protocols.xml"/>

</SPConfig>


Cheers,
George



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20220223/5c272f45/attachment.htm>