JSON dictionary in the Relay State parameter

[Florian Lengyel]

I have been tasked with moving service providers from Shibboleth 4.0.1 to Oracle Access Manager 12.c. This has been largely straightforward, except for two service providers (so far) that use the Relay State parameter to send a JSON dictionary of the form

`{"key1":"value1", ... , "keyN":"valueN"}

to the IdP with the expectation that the IdP will return this value verbatim to the service provider along with the SAML Response.

Oracle Access Manager sanitizes the unsafe curly brackets and double quotes, in accordance with the OASIS SAML 2.0 standard, by replacing the unsafe characters with a diamond containing a question mark. That leads to login failures.

Shibboleth version 4.0.1 allowed unusual Relay State parameters such as JSON dictionaries--perhaps I overlooked a configuration I should have set.

My understanding is that the Relay State should contain an opaque identifier, whose interpretation is known only by the service provider. Am I mistaken? Service provider implementations are supposed to follow the standard and not send data structure through the Relay State parameter.

I have asked two service providers so far to comply with the standard or accept the sanitized Relay State returned by the IdP. How common is sending JSON through the Relay State?

FL

Get Outlook for Android<https://aka.ms/ghei36>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240323/4d3d011d/attachment.htm>