<html><body><div style="color:#000; background-color:#fff; font-family:Courier New, courier, monaco, monospace, sans-serif;font-size:16px">I recently setup a connection with a new IDP and sent them an SP init link. They responded with this:<br><br><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;" id="yui_3_16_0_1_1420558808857_5675">We’re having a problem on our end with the request URL that your SAML server is creating. The SAMLRequest parameter consistently contains several %0A escape characters, which, when decoded, are newline characters. These are generally not allowed as they are used by hackers to try to hijack code, and our Forefront TMG firewall proxy doesn’t allow them at all.<br> <br>Can your system be configured to not use either the %0A or %0D escape characters? (I didn’t see the latter one, only the first, but I’ve included it for completeness.) If you are able to double escape the parameter so that the percent sign is rendered as %25 creating %250A, we can probably prevent our firewall from double decoding the URL, if that’s any help.<br> <br>Let me know what you think.</blockquote><div id="yui_3_16_0_1_1420558808857_5554"><br></div><div id="yui_3_16_0_1_1420558808857_5553" dir="ltr">And, indeed, this is the case. Here is the authN sent to them:</div><div id="yui_3_16_0_1_1420558808857_5553" dir="ltr"><br></div><div id="yui_3_16_0_1_1420558808857_5553" dir="ltr">SAMLRequest=fZFfT4MwFMW%2FCuk7FNhQ1wwS3B5cMpUM9MEXU0oZTUqLvcW5by8D%2F8wH93jT%0Ac88599cl0FZ2JO1to3b8redgnY9WKiDjQ4x6o4imIIAo2nIglpE8vd%2BS0PNJ%0AZ7TVTEvkpADcWKHVSivoW25ybt4F40%2B7bYwaazsgGEMjSk8eVUU9plucD2Op%0AJbeNB6DxyTXE2WNeIGc91BCKngx%2F12lVg3cQ0Hja7McJS8DI2axj9DqrwkXA%0A%2FBkvF1U0Z2U9Cxe8Dug1q0q%2FnLNBBtDzjQJLlY1R6AeR6weuf1UEEQkjMr95%0AQU72ddCtUJVQ%2B8vXl5MIyF1RZO5U%2FJkbGEsPApQsTwzJGGzOqF62pd8oUfIP%0AOPgB50K3xGchU2JHHgbXzTrTUrCjk0qpDyvDqeUxChBOppW%2Fn558Ag%3D%3D%0A&RelayState=cookie%3Aa3539135<br></div><div id="yui_3_16_0_1_1420558808857_5553" dir="ltr"><br></div><div id="yui_3_16_0_1_1420558808857_5553" dir="ltr">Now, just for grins I looked at authN for a number of other connections. They all do this and the IDPs seems to be fine with it. Is there any way to disable these escape chars for this this one IDP using a relying party rule or anything? My searching has not uncovered anything useful :(</div><div id="yui_3_16_0_1_1420558808857_5553" dir="ltr" class="" style=""><br class="" style=""></div></div></body></html>