<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 9/28/16 10:59 AM, Liam Hoekenga
wrote:<br>
</div>
<blockquote
cite="mid:CAH4ZtKRhP5jY8-59akSiB_Cd4+akiFVLfxqJSg+pTjOW=CKWXg@mail.gmail.com"
type="cite">
<div dir="ltr">We recently had a problem where one of our SPs
entityID's contained trailing spaces, but the metadata we had on
the IdP did not. So we got a request that looked like...</div>
</blockquote>
<blockquote type="cite"> <saml:Issuer
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"><a
href="https://service.example.umich.edu/">https://service.example.umich.edu/</a>
</saml:Issuer></blockquote>
<br>
<blockquote
cite="mid:CAH4ZtKRhP5jY8-59akSiB_Cd4+akiFVLfxqJSg+pTjOW=CKWXg@mail.gmail.com"
type="cite">
<div dir="ltr">
<div><br>
<div>but our response was for "<a moz-do-not-send="true"
href="https://service.example.umich.edu/">https://service.example.umich.edu/</a>".
Unsurprisingly, their SP did not like receiving a response
for the wrong entityID, and we had a merry little POST fest.</div>
</div>
</div>
</blockquote>
<br>
At first I thought you were going to say it didn't work ... but
you're saying it did "work" in that the IdP did successfully issue a
response. And the SP couldn't match it to its own entityID b/c its
own in-process storage of its own entityID contained a trailing
space.<br>
<br>
I'm jumping ahead, but that sounds like an SP bug to me, not an IdP
one. The SP deployer obviously shouldn't have put the trailing
space, but I think the SP should be normalizing it (and probably
most all config values) to remove leading and trailing whitespace.
This isn't a Shib SP, is it? That would be a little surprising.<br>
<br>
<br>
<blockquote
cite="mid:CAH4ZtKRhP5jY8-59akSiB_Cd4+akiFVLfxqJSg+pTjOW=CKWXg@mail.gmail.com"
type="cite">
<div dir="ltr">
<div><br>
</div>
<div>Shouldn't the IdP have denied the entityID with the
trailing spaces? We didn't have metadata that matched that
entityID.</div>
<br>
</div>
</blockquote>
<br>
Scott can weigh in if he thinks I'm wrong, but I think it worked as
expected. Leading and trailing whitespace inside an XML element
value is usually not considered semantically significant, and it is
stripped out when evaluating it.<br>
<br>
Imagine this similar perfectly valid pretty-printed XML snippet:<br>
<br>
<tt><saml:Issuer
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"></tt><tt><br>
</tt><tt> <a class="moz-txt-link-freetext" href="https://service.example.umich.edu/">https://service.example.umich.edu/</a></tt><tt><br>
</tt><tt></saml:Issuer></tt><tt><br>
</tt><br>
<br>
Would you expect that the embedded newlines (and spaces) are
syntactically part of the entityID? I wouldn't.<br>
<br>
<br>
</body>
</html>