JSON dictionary in the Relay State parameter

[Florian Lengyel]

> And in that case, the IdP is supposed to send the RelayState back to the SP verbatim, if I
> understand Scott correctly.

Not verbatim, because URL encoding isn't canonical. Multiple encoded strings can decode to the same value. As an example, both '+' and '%20' are used to denote spaces, but either is allowed. The string may be different at both steps because the encoding process is different, but the decoded value has to be the same in the end or somebody did it wrong.

For the sake of accuracy, the issue where '+' and '%20' both decode to a space character reflects non-injectivity in the encoding scheme—different encodings leading to the same decoded value. This is distinct from non-canonicity, which would involve variations in standard representation. But other than that, point taken.

> Before I head off to saml-dev about the OASIS spec, there seem to be three takes on the
>  matter.

There really aren't, and the errata doesn't enter into it. The errata has to do with SPs protecting themselves in their usage of the field, it has no bearing on the actual requirement on the IdP to be 100% faithful in returning the value.

--Scott

OK, I'll let Oracle know.

Many thanks!

Florian

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240325/99032b8a/attachment.htm>