<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">The character before the 'action' was indeed an ampersand, and this is rejected by the IdP. When I urlencode it manually (using the <a href="https://rnd.feide.no/simplesaml/module.php/saml2debug/debug.php">Feide SAML debugger</a>) the IdP parses it.<div>Thanks</div><div>Glenn<br><div><br></div><div><br><div>Edugate Operations<br>HEAnet Limited, Ireland's Education and Research Network - <br>1st Floor, 5 George's Dock, IFSC, Dublin 1<br>Registered in Ireland, no 275301 tel: +353-1-6609040 fax: +353-1-6603666<br></div><br><div><div>On 7 Feb 2013, at 10:31, Ian Young wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div><br>On 7 Feb 2013, at 09:54, Glenn Wearen <<a href="mailto:glenn.wearen@heanet.ie">glenn.wearen@heanet.ie</a>> wrote:<br><br><blockquote type="cite">Slight correction, it is the ampersand that I have urlencoded, not the question mark.<br></blockquote><br>The example you posted doesn't contain an ampersand. If the character before the "action" was an ampersand, that would be invalid XML, which is what the IdP is reporting.<br><br>As to whether the "right" answer is for the SP to URL encode such an ampersand as %25 within the XML, in the hope that it won't be decoded prior to being used in a URL, I'm not sure. I have seen that done, but if you don't have control over what the SP is generating then that may be moot.<br><br>There was a change in behaviour in this area in the IdP at some point in the 2.X series. I want to say something like 2.2.0, but I can't see the specific issue in the release notes; it may have been a side-effect of fixing something else and perhaps someone else can remember the details. We've also had related issues in the discovery service code. I do remember that we were fairly confident that the IdP was doing the right thing now, though.<br><br><span class="Apple-tab-span" style="white-space:pre"> </span>-- Ian<br><br><br><br>--<br>To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a></div></blockquote></div><br></div></div></body></html>