<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<div class="moz-cite-prefix">On 1/16/15 4:25 PM, Brent Putman wrote:<br>
</div>
<blockquote cite="mid:54B981B2.6030709@georgetown.edu" type="cite"><br>
<pre wrap="">
Yeah, me either. I can look, but I don't recall any special handling of
RelayState. We just pull it in as a String and it gets sent back out
unmolested, as far as I know.
</pre>
</blockquote>
<br>
There is no special handling. Assuming outbound is SAML 2 POST: I
used the unit tests to confirm correct output when it's a "/":<br>
<br>
<tt><input type="hidden" name="RelayState"
value="&#x2f;"/> </tt><br>
<br>
(which is the HTML-encoded form, as expected).<br>
<br>
Also confirmed that the SAML 2 Redirect decoder doesn't lose it. If
this isn't a Shib SP, it's possible that they have a bug and are
using an incorrect parameter name (wrong case, etc) and so the
decoder isn't picking it up.<br>
<br>
Otherwise, I don't see how this could happen. If you still think
this to be the case, I would need to see the actual inbound redirect
binding URL (e.g. from Firefox LiveHeaders) and the form that's
being sent outbound (turn off Javascript in your browser and
examine/save the web page HTML).<br>
<br>
<br>
<blockquote cite="mid:54B981B2.6030709@georgetown.edu" type="cite">
</blockquote>
<br>
</body>
</html>