<div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div class="gmail_extra"><br><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div style="font-family:"trebuchet ms",sans-serif">Hi All,</div><div style="font-family:"trebuchet ms",sans-serif"><br></div><div style="font-family:"trebuchet ms",sans-serif">One of our customer has configured our application with Shibboleth SSO to achieve single sign on application. He has raised an issue that login is not successful when the user needs to be redirected to the uri mentioned in the "redirect" query string after successful login. The redirection is made to a apache-CAS server <a href="http://cas.example.com" target="_blank">http://cas.example.com</a> (configured with mod_auth_cas).</div><div><font face="trebuchet ms, sans-serif"><br></font></div><div style="font-family:"trebuchet ms",sans-serif">This is the url that shibboleth server gets at login page:</div><div style="font-family:"trebuchet ms",sans-serif"><a href="https://shib.example.com/sso/module.php/core/loginuserpass.php?redirect=" target="_blank">https://shib.example.com/sso/m<wbr>odule.php/core/loginuserpass.p<wbr>hp?redirect=</a>"<a href="http://cas.example.com/library?field1=value1&1,,2,2,0" target="_blank">http://cas.exampl<wbr>e.com/library?field1=value1&1,<wbr>,2,2,0</a>" </div><div style="font-family:"trebuchet ms",sans-serif"><br></div><div style="font-family:"trebuchet ms",sans-serif">In our analysis we found that the reason was that: the redirect url has a query string without values something like: <a href="http://cas.example.com/library?field1=value1&1,,2,2,0" target="_blank">http://cas.example.com/library<wbr>?field1=value1&1,,2,2,0</a> and when login was done, shibboleth server added "=" like <a href="http://cas.example.com/library?field1=value1&1,,2,2,0" target="_blank">http://cas.example.com/library<wbr>?field1=value1&1,,2,2,0</a><b>=</b> by assuming that "1,,2,2,0" to be an empty key. Apache-CAS server throws error when it finds a change in the url that is returned by the shibboleth.</div><div style="font-family:"trebuchet ms",sans-serif"><br></div><div style="font-family:"trebuchet ms",sans-serif">Error thrown by CAS server : </div><div><font face="trebuchet ms, sans-serif">response = <?xml version="1.0"?>\n<cas:serviceR<wbr>esponse xmlns:cas="<a href="http://www.yale.edu/tp/cas" target="_blank">http://www.yale.edu<wbr>/tp/cas</a>">\n<cas:authentication<wbr>Failure code="INVALID_SERVICE">Mismatc<wbr>hing service parameters: expected '<a href="https://cas.example.com/" target="_blank">https://cas.example.com/</a></font><span style="font-family:"trebuchet ms",sans-serif">libra<wbr>ry</span><font face="trebuchet ms, sans-serif">?redirect=<a href="https://cas" target="_blank">https://cas</a></font><span style="font-family:"trebuchet ms",sans-serif">.<a href="http://example.com" target="_blank">exampl<wbr>e.com</a></span><font face="trebuchet ms, sans-serif">:443/</font><span style="font-family:"trebuchet ms",sans-serif">library</span><font face="trebuchet ms, sans-serif">?/pblackwell/<wbr>pblackwell/1,1,2,B/l962~107070<wbr>5&FF=pblackwell+pamela&<wbr>amp;1,,2,0,0' but was: 'https://</font><font face="trebuchet ms, sans-serif">cas</font><span style="font-family:"trebuchet ms",sans-serif">.<a href="http://example.com" target="_blank">example.com</a></span><font face="trebuchet ms, sans-serif">:443/</font><span style="font-family:"trebuchet ms",sans-serif">l<wbr>ibrary</span><font face="trebuchet ms, sans-serif">?%2F0%2Fredirect=https%3<wbr>A%2F%2F</font><font face="trebuchet ms, sans-serif">cas</font><span style="font-family:"trebuchet ms",sans-serif">.<a href="http://example.com" target="_blank">example.com</a></span><font face="trebuchet ms, sans-serif">:443/</font><span style="font-family:"trebuchet ms",sans-serif">lib<wbr>rary</span><font face="trebuchet ms, sans-serif">%3F%2Fpblackwell%2Fpblackw<wbr>ell%2F1%2C1%2C2%2CB%2Fl962%<wbr>7E1070705&FF=pblackwell+<wbr>pamela&1%2C%2C2%2C0%2C0='<<wbr>/cas:authenticationFailure>\n<<wbr>/cas:serviceResponse>,</font><br></div><div><br></div><div><div style="font-family:"trebuchet ms",sans-serif">If we change the redirect url to "<a href="http://cas.example.com/library?field1=value1&1,,2,2,0=" target="_blank">http://cas.example.com/libra<wbr>ry?field1=value1&1,,2,2,0=</a>" (with an equal to at the end). so that the shibboleth server gets redirect query param with "=", then login happens successfully. Something like</div><div style="font-family:"trebuchet ms",sans-serif"><div><a href="https://shib.example.com/sso/module.php/core/loginuserpass.php?redirect=" target="_blank">https://shib.example.com/sso/m<wbr>odule.php/core/loginuserpass.p<wbr>hp?redirect=</a>"<a href="http://cas.example.com/library?field1=value1&1,,2,2,0=" target="_blank">http://cas.exampl<wbr>e.com/library?field1=value1&1,<wbr>,2,2,0=</a>" </div></div><br></div><div><br></div><div><div style="font-family:"trebuchet ms",sans-serif">According to the URI spec <a href="http://tools.ietf.org/html/rfc3986#section-3.4" rel="nofollow noreferrer" style="margin:0px;padding:0px;border:0px;font-variant-numeric:inherit;font-variant-east-asian:inherit;font-stretch:inherit;font-size:15px;line-height:inherit;font-family:Arial,"Helvetica Neue",Helvetica,sans-serif;vertical-align:baseline;color:rgb(0,89,153);text-decoration-line:none" target="_blank">RFC 3986 here</a>, there is no rule that an uri should always contain key=value pairs. We can mention just key to know the presence of some parameter. Since our application can be configured with other SSO servers also and also it is not industry standard to always have key=value pairs, we donot think it will be a good idea to change our application to include "=" after param "1,,2,2,0". Could you please let us know what configuration changes should be done at Shibboleth server that we can convey to our customers to solve this issue.</div><div style="font-family:"trebuchet ms",sans-serif"><br></div><div style="font-family:"trebuchet ms",sans-serif"><br></div><div style="font-family:"trebuchet ms",sans-serif">Thanks and Regards,</div><div style="font-family:"trebuchet ms",sans-serif">Virajith<div class="gmail_default" style="font-family:"trebuchet ms",sans-serif;display:inline">a</div></div></div><span class="HOEnZb"><font color="#888888"><span class="m_2311305790560368266HOEnZb"><font color="#888888"><div><br></div></font></span></font></span></div></blockquote></div></div></div></blockquote></div>
</div></div>