<div dir="ltr">I have an SP that needs to use parameters in the ACS URL. Luckily, they are capable of encoding it but we haven't been able to get it right.<div><br></div><div>The desired ACS url is, without encoding is:</div>
<div><br></div><div><a href="https://secure.terranovasite.com/LMS/login/saml2/tnsso_ACS.aspx?e=561e8185-621e-49c1-9856-7013f9d8491&lang=en&t=1">https://secure.terranovasite.com/LMS/login/saml2/tnsso_ACS.aspx?e=561e8185-621e-49c1-9856-7013f9d8491&lang=en&t=1</a><br>
</div><div><br></div><div>In the AuthnRequest and metadata, we are using:</div><div><br></div><div><a href="https://secure.terranovasite.com/LMS/login/saml2/tnsso_ACS.aspx?e=561e8185-621e-49c1-9856-7013f9d8491c%26lang=en%26t=1">https://secure.terranovasite.com/LMS/login/saml2/tnsso_ACS.aspx?e=561e8185-621e-49c1-9856-7013f9d8491c%26lang=en%26t=1</a><br>
</div><div><br></div><div>However, it appears that when this URL is processed by Velocity, the '%' is re-encoded again and it ultimately yields the following URL:</div><div><br></div><div><div><a href="https://secure.terranovasite.com/LMS/login/saml2/tnsso_ACS.aspx?e=561e8185-621e-49c1-9856-7013f9d8491&lang">https://secure.terranovasite.com/LMS/login/saml2/tnsso_ACS.aspx?e=561e8185-621e-49c1-9856-7013f9d8491&lang</a><br>
</div></div><div><br></div><div><br></div><div>What is the proper encoding to use in the AuthnRequest and metadata?</div><div><br></div><div>For reference, I've included logs:</div><div><br></div><div><br></div><div><div>
01:48:19.909 - DEBUG [org.opensaml.saml2.binding.AuthnResponseEndpointSelector:69] - Selecting endpoint by ACS URL '<a href="https://secure.terranovasite.com/LMS/login/saml2/tnsso_ACS.aspx?e=561e8185-621e-49c1-9856-7013f9d8491c%26lang=en%26t=1">https://secure.terranovasite.com/LMS/login/saml2/tnsso_ACS.aspx?e=561e8185-621e-49c1-9856-7013f9d8491c%26lang=en%26t=1</a>' and protocol binding 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST' for request '<a href="https://secure.terranovasite.com/lms/login/saml2/">https://secure.terranovasite.com/lms/login/saml2/</a>' from entity '<a href="https://secure.terranovasite.com/lms/login/saml2/">https://secure.terranovasite.com/lms/login/saml2/</a>'</div>
<div>01:48:20.060 - DEBUG [org.opensaml.common.SAMLObjectHelper:56] - Examing signed object for content references with exclusive canonicalization transform</div><div>01:48:20.060 - DEBUG [org.opensaml.common.SAMLObjectHelper:70] - Saw exclusive transform, declaring non-visible namespaces on signed object</div>
<div>01:48:20.067 - DEBUG [org.opensaml.xml.signature.impl.SignatureMarshaller:100] - Starting to marshall {<a href="http://www.w3.org/2000/09/xmldsig#}Signature">http://www.w3.org/2000/09/xmldsig#}Signature</a></div><div>
01:48:20.068 - DEBUG [org.opensaml.xml.signature.impl.SignatureMarshaller:103] - Creating XMLSignature object</div><div>01:48:20.068 - DEBUG [org.opensaml.xml.signature.impl.SignatureMarshaller:113] - Adding content to XMLSignature.</div>
<div>01:48:20.069 - DEBUG [org.opensaml.common.impl.SAMLObjectContentReference:174] - Adding list of inclusive namespaces for signature exclusive canonicalization transform</div><div>01:48:20.072 - DEBUG [org.opensaml.xml.signature.impl.SignatureMarshaller:118] - Creating Signature DOM element</div>
<div>01:48:20.077 - DEBUG [org.opensaml.xml.signature.Signer:76] - Computing signature over XMLSignature object</div><div>01:48:20.096 - DEBUG [org.opensaml.ws.message.encoder.BaseMessageEncoder:49] - Beginning encode message to outbound transport of type: org.opensaml.ws.transport.http.HttpServletResponseAdapter</div>
<div>01:48:20.097 - DEBUG [org.opensaml.saml2.binding.encoding.HTTPPostEncoder:124] - Invoking Velocity template to create POST body</div><div>01:48:20.146 - DEBUG [org.opensaml.saml2.binding.encoding.HTTPPostEncoder:158] - Encoding action url of '<a href="https://secure.terranovasite.com/LMS/login/saml2/tnsso_ACS.aspx?e=561e8185-621e-49c1-9856-7013f9d8491c%26lang">https://secure.terranovasite.com/LMS/login/saml2/tnsso_ACS.aspx?e=561e8185-621e-49c1-9856-7013f9d8491c%26lang</a>' with encoded value 'https&#x3a;&#x2f;&#x2f;<a href="http://secure.terranovasite.com">secure.terranovasite.com</a>&#x2f;LMS&#x2f;login&#x2f;saml2&#x2f;tnsso_ACS.aspx&#x3f;e&#x3d;561e8185-621e-49c1-9856-7013f9d8491c&#x25;26lang'</div>
</div><div><br></div></div>