<span style="font-family: arial, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255); ">Dear Shib Users,</span><div style="font-family: arial, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255); ">
A crafty user has created a report that generates an excel file which will display a list of errors for their problem domain and a link to the specific record in the web application that manages that domain. The application is protected by shibboleth. All of the individual links work, they just do not work in when clicking them in Excel in Windows.</div>
<div style="font-family: arial, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255); "><br></div><div style="font-family: arial, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255); ">It seems that this problem is documented:</div>
<div style="font-family: arial, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255); "><a href="http://shibboleth.1660669.n2.nabble.com/links-in-Microsoft-office-break-shibboleth-login-td5186632.html" target="_blank" style="color: rgb(0, 0, 204); ">http://shibboleth.1660669.n2.nabble.com/links-in-Microsoft-office-break-shibboleth-login-td5186632.html</a></div>
<div style="font-family: arial, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255); "><br></div><div style="font-family: arial, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255); "><a href="https://groups.google.com/group/shibboleth-users/browse_thread/thread/f5947a2e99fff37e/11b670f90f9cd550?lnk=gst&q=word+link+problem&pli=1#11b670f90f9cd550" target="_blank" style="color: rgb(0, 0, 204); ">https://groups.google.com/group/shibboleth-users/browse_thread/thread/f5947a2e99fff37e/11b670f90f9cd550?lnk=gst&q=word+link+problem&pli=1#11b670f90f9cd550</a></div>
<div style="font-family: arial, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255); "><br></div><div style="font-family: arial, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255); ">After some debugging, this is clearly an Excel problem, the root of which seems to be that Excel makes the initial http call and does not invoke the browser until it gets an http 200 response code (and in a normal interaction there would be a few redirects before you get to the login page). The effect is that the user's browser arrives at the Shibboleth IdP login screen, not knowing which SP this request is for and so the process fails after login. I have tried to work through this with both SP and IdP initiated AuthN and since they both use redirects, the error is the same.</div>
<div style="font-family: arial, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255); "><br></div><div style="font-family: arial, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255); ">On the surface it seems like there is a problem with Shibboleth, particularly since a diligent, non technical user will paste the link into their browser to confirm it works at all before calling.</div>
<div style="font-family: arial, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255); "><br></div><div style="font-family: arial, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255); ">As in the preceding posts, I do not have a work around in Excel (e.g. a way to make Excel open the browser and then pass in the link), so if someone does, please let me know.<br clear="all">
<div><br></div><div>At the very least this might server as a warning to others that this issue exists and your IdP works fine.</div></div><div><br></div>-- <br>Michael J. McDermott<br>Lead Developer, Identity and Access Management<br>
Brown University<br><br><br>