<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">Il 29/07/2015 15:37, Peter Schober ha
scritto:<br>
</div>
<blockquote cite="mid:20150729133715.GQ1303@aco.net" type="cite">
<pre wrap="">* Teresa Fasano <a class="moz-txt-link-rfc2396E" href="mailto:t.fasano@cineca.it"><t.fasano@cineca.it></a> [2015-07-29 15:00]:
</pre>
<blockquote type="cite">
<pre wrap="">When the user needs to log on to the IDP it is redirected to <a class="moz-txt-link-freetext" href="https://">https://</a><url>,
losing all part of the url after "#".
Instead, if the user is already logged on the IDP it is correctly redirected
to the original URL, including the character "#".
</pre>
</blockquote>
<pre wrap="">
Re-reading this you're saying that the SP keeps the "correct" (incl
the fragment identifier) URI if the browser has an SSO session at the
IDP, but the URI is missing the fragment identifier if I have to enter
credentials at the IDP?</pre>
</blockquote>
<br>
<div style="display: inline-block;" id="gt-input-tool">
<div><span class="ita-kd-inputtools-div"></span></div>
</div>
<div id="gt-src-c" class="g-unit">
<div id="gt-src-p"> </div>
</div>
<div id="gt-res-content" class="almost_half_cell">
<div dir="ltr" style="zoom:1">
<div id="tts_button"><object
type="application/x-shockwave-flash"
data="//ssl.gstatic.com/translate/sound_player2.swf"
id="tts" height="18" width="18"></object></div>
<span id="result_box" class="" lang="en"><span class="hps">Yes,</span>
<span class="hps">it is.</span><br>
<span class="hps">If I have to</span> <span class="hps">log
in</span> <span class="hps atn">(</span><span class="">enter
credentials</span> <span class="hps">on the login page</span><span
class="">)</span><span>,</span> <span class="hps">after the
authentication</span> the <span class="hps">URL</span> <span
class="hps">becomes</span> <span class="hps">https</span><span>:</span><span
class="hps">//</span><span class="hps atn"><</span><span
class="">url</span><span class="">></span> <span
class="hps">without</span> <span class="hps">the part
relating</span> <span class="hps">to the character</span> <span
class="hps">#</span><span>.</span><br>
<span class="hps">Instead,</span></span><span id="result_box"
class="" lang="en"><span class="hps"><span id="result_box"
class="" lang="en"><span class="hps"></span> <span
class="hps">if</span> <span class="hps">I'm</span> <span
class="hps">already authenticated</span><span class="">,</span>
<span class="hps">the URL</span> <span class="hps">is</span>
<span class="hps atn">"</span><span class="">https</span><span
class="">:</span> <span class="hps">//</span> <span
class="hps atn"><</span><span>url</span><span>></span>
<span class="hps">=</span> <span class="hps">#</span> <span
class="hps">filter</span> <span class="hps">....</span><span
class="">"</span><span class="">.</span></span> </span><span
class=""></span></span></div>
</div>
<blockquote cite="mid:20150729133715.GQ1303@aco.net" type="cite">
<pre wrap="">
I don't see how that's possible. The data sent and received from the
SP to the IDP and back would be the same (modulo differences wrt
Assertion/@IssueInstant and AuthnStatement/@AuthnInstant, which should
be irrelevant to this behaviour) whether I had to authenticate with
the IDP or had an SSO session established with the IDP earlier.
Also, since the SP doesn't know whether my browser will experience SSO
at the IDP or not, it would need to perform the same steps to save off
the accessed URI and reference it in the RelayState sent to the IDP.
-peter
</pre>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">--
----------------------------------
L'educazione è il pane dell'anima
----------------------------------
Teresa Fasano
CINECA
System and Technologies Department
Middleware and Infrastructure Group
Via Magnanelli, 6/3
Casalecchio di Reno (Bologna) ITALY
web: <a class="moz-txt-link-freetext" href="http://www.cineca.it">http://www.cineca.it</a>
e-mail: <a class="moz-txt-link-abbreviated" href="mailto:t.fasano@cineca.it">t.fasano@cineca.it</a>
phone: +39 051 61 71 364
</pre>
</body>
</html>