<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 8/30/17 11:23 AM, Cantor, Scott
wrote:<br>
</div>
<br>
<blockquote type="cite"
cite="mid:9846A6064BD102419D06814DD0D78DE149DCF11D@CIO-KRC-D2MBX08.osuad.osu.edu">
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">The SAMLRequest parameter value from the above HTTPRequest which
caused the above error. This was decoded using the <a class="moz-txt-link-freetext" href="http://rnd.feide.no/">http://rnd.feide.no/</a>
SAML2 debugger tool:
</pre>
</blockquote>
<pre wrap="">
That means it could not have caused that ZIP exception. Thus my conclusion.</pre>
</blockquote>
<br>
Well, the FEIDE tool is absolutely lax about DEFLATE, since they
dynamically support Redirect and POST on the same tool, with no
options to specify what it is:<br>
<br>
<br>
<blockquote type="cite"
cite="mid:9846A6064BD102419D06814DD0D78DE149DCF11D@CIO-KRC-D2MBX08.osuad.osu.edu"></blockquote>
<blockquote type="cite">Paste in a SAML message encoded with the
HTTP-POST or HTTP-REDIRECT encoding. You can both use the full URL
that you copied from LiveHTTPHeaders, or you can paste in only the
SAMLRequest or SAMLResponse parameter. It will be automatically
detected whether you post a URL or the value it self and whether
you post a HTTP-REDIRECT or HTTP-POST encoded value. enjoy!</blockquote>
<br>
<br>
So it's going to accept invalid inputs for either binding and still
decode them.<br>
<br>
<br>
But, taking another view: since it seems we know (correct?) this is
a Shib SP, and that's pretty well established to not be screwing up
the Redirect binding, it could be that the sample HTTP request sent
in the other message is miscorrelated with the OpenSAML errors.<br>
</body>
</html>