<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Hi, all,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We’re having a problem with the Shib Centralized DS and doubly-encoded URLs. A string that we’re encoding twice because it’s supposed to still be URL-encoded when it gets back to the SP seems to be decoded.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We use the Shib centralized discovery service in front of our university’s enterprise Box account because the three Illinois campuses, each with their own IDP, share the enterprise account. Box, in the beta of their new sync service, has
the need to include a parameter as part of the return URL that is, itself, another URL. They want that parameter value to remain URL-encoded when it gets back to them.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Of course, the DS also expects the return URL to be URL-encoded. So, the smart folks at Box decided they’d just encode the parameter, then encode the whole return URL string. End result: the parameter is now doubly encoded.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Funny thing is that, by the time the return URL gets back to Box, even the parameter seems to be completely decoded… as if the DS id decoding twice.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">So, they’re seeing the DS returning to this:<o:p></o:p></p>
<p class="MsoNormal">https://sso.services.box.net/sp/startSSO.ping?TargetResource=https://www.box.com/api/oauth2/authorize?response_type=code&client_id=pbwjkgj4xxa9jifscs2zv3dzq1t96ykc&redirect_uri=https%3A%2F%2Fgoogle.com%2F&PartnerIdpId=urn:mace:incommon:uiuc.edu<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Instead, they’re expecting the returnX URL parameter to be URL decoded once like this<o:p></o:p></p>
<p class="MsoNormal">https://sso.services.box.net/sp/startSSO.ping?TargetResource=https%3A%2F%2Fwww.box.com%2Fapi%2Foauth2%2Fauthorize%3Fresponse_type%3Dcode%26client_id%3Dpbwjkgj4xxa9jifscs2zv3dzq1t96ykc%26redirect_uri%3Dhttps%253A%252F%252Fgoogle.com%252F&returnIDParam=PartnerIdpId&action=selection&select=Select
this campus&cache=session<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Is the DS doing some logic after it decodes the return URL to see if it still seems to have further decoding in it and, if it does, looping through again? Or do we need to look beyond the DS to find the source of this craziness?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
<p class="MsoNormal">Keith<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>