<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body>
<div dir="auto">I have been tasked with moving service pr<span>oviders from Shibboleth 4.0.1 to Oracle Access Manager 12.c. This has been largely straightforward, except for two service providers (so far) that use the Relay State parameter to send a JSON dictionary
of the form</span></div>
<div dir="auto"><span><br>
</span></div>
<div dir="auto"><span>`{"key1":"value1", ... , "keyN":"valueN"}</span></div>
<div dir="auto"><span><br>
</span></div>
<div dir="auto"><span>to the IdP with the expectation that the IdP will return this value verbatim to the service provider along with the SAML Response.</span></div>
<div dir="auto"><br>
</div>
<div dir="auto">Oracle Access Manager sanitizes the unsafe curly brackets and double quotes, in accordance<span> with the</span><span style="font-size: 12pt;"> OASIS SAML 2.0 standard, by replacing the unsafe characters with a diamond containing a question
mark. </span><span style="font-size: 12pt;">That leads to login failures. </span></div>
<div dir="auto"><span style="font-size: 12pt;"><br>
</span></div>
<div dir="auto"><span style="font-size: 12pt;">Shibboleth version 4.0.1 allowed unusual Relay State parameters such as JSON dictionaries--perhaps I overlooked a configuration I should have set.</span></div>
<div dir="auto"><span style="font-size: 12pt;"><br>
</span></div>
<div dir="auto"><span style="font-size: 12pt;">My under<span>standing is that the Relay State should contain an opaque identifier, whose interpretation is known only by the service provider. </span></span><span style="font-size: 12pt;">Am I mistaken? Service
provider implementations are supposed to follow the standard and not send data structure through the Relay State parameter. </span></div>
<div dir="auto"><span style="font-size: 12pt;"><br>
</span></div>
<div dir="auto"><span style="font-size: 12pt;">I have asked two service <span>providers so far to comply with the standard or accept the sanitized Relay State returned by the IdP. How common is sending JSON through the Relay <span>State? </span></span></span></div>
<div dir="auto"><span style="font-size: 12pt;"><br>
</span></div>
<div dir="auto"><span style="font-size: 12pt;">FL</span></div>
<div id="ms-outlook-mobile-signature" dir="auto">
<div><br>
</div>
Get <a href="https://aka.ms/ghei36">Outlook for Android</a></div>
</body>
</html>