JSON dictionary in the Relay State parameter

[Florian Lengyel]

... with the expectation that the IdP will return this value verbatim to the service provider along with the SAML Response.


Yes, that is a requirement in the spec.


Oracle Access Manager sanitizes the unsafe curly brackets and double quotes, in accordance with the OASIS SAML 2.0 standard, by replacing the unsafe characters with a diamond containing a question mark. That leads to login failures.


That result seems not correct if it's emitting a "diamond containing a question mark".


I was typing on my phone and wasn't in a position to type the unicode character, but here it is: �

You didn't mention the outbound binding, but assuming it's POST, that ought to come out as HTML-encoded. However...


POST

If the SP is actually sending the JSON as a literal JSON string, then that's unwise, for this exact reason.

Indeed,it is, as I wrote in my original message. It's not a hypothetical. It's a matter of fact.

A better approach would be to encode it so that it is a completely URL- or HTML-safe string, so that no party will mutate it and cause lack of fidelity with the original data. Base64 (or really Base64URL) would be a good choice.

Of course.

If you want to go to these 2 vendors and ask them to fix something, that seems the more bulletproof approach. But see below for the actual requirements.  JSON - encoded or not - is quite possibly too large.


Shibboleth version 4.0.1 allowed unusual Relay State parameters such as JSON dictionaries--perhaps I overlooked a configuration I should have set.


We try to adhere to the spec.




The other requirement though is that it is limited to 80 bytes in size (RFC "MUST NOT" exceed). An arbitrary JSON object could easily violate that. I'd check what they are actually sending

I have. I'm not including it here.

and if they're over that limit, you can point out that that is a clear spec violation.

Ok. One is over the 80 byte limit, one is under. Both send JSON dictionaries.

If you want all the details, look at the SAML 2.0 Bindings spec doc. Section 3.4.3 is for the Redirect binding and 3.5.3 is for POST binding (but they're basically identical).


 How common is sending JSON through the Relay State?


I doubt it's common and I personally haven't ever seen or heard of a vendor doing it.

I am aware of two.


But it's not technically disallowed as far as I know, as long as it's under the 80 byte limit. But it's probably not the wisest approach.

It's possible that Oracle over-interpreted the spec. Thanks for your reply.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240324/4c160253/attachment.htm>