JSON dictionary in the Relay State parameter

[Cantor, Scott]

> My intention in this discussion is not to be confrontational but to seek a shared
> understanding of the SAML 2.0 specifications, especially regarding handling the
> RelayState. According to the text from Errata E90: 

I don't know what it is you're asking for here. The important rules are that like any query or form parameter, it has to be URL encoded for transmission, then it's decoded, and re-encoded by the IdP to return it. That's ultimately the only rule that matters for interop sake, and your Oracle IdP is, huge shock, broken. That will not be the only bug, trust me.

The IdP isn't meant to "act" on the value, so any problems with it are a matter for the SP to deal with, and that is more or less what the concerns are. It's not generally protected by a signature, so if you pass a literal value it is subject to manipulation, and that's why the errata was done, to call that out. But the IdP doesn't care about that and in no case can or will an IdP be expected to *change* the value. There is no santization possible on that side, just URL decode and then encode.

Even the underlying character encoding is irrelevant, because URL encoding/decoding is, while not canonical, able to turn any encoded string into a safe value that will be recovered on the other end as the original string of bytes. Mapping that into a character string is up to the software that created it, the SP.

-- Scott