<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<div dir="auto"><br>
</div>
<div id="mail-editor-reference-message-container" dir="auto">
<div dir="auto">
<blockquote type="cite"><span>... with the expectation that the IdP will return this value verbatim to the service provider along with the SAML Response.</span></blockquote>
<p><br>
</p>
<p>Yes, that is a requirement in the spec.<br>
</p>
<p><br>
</p>
<blockquote type="cite">
<div dir="auto"><br>
</div>
<div dir="auto">Oracle Access Manager sanitizes the unsafe curly brackets and double quotes, in accordance<span> with the</span><span style="font-size:12pt"> OASIS SAML 2.0 standard, by replacing the unsafe characters with a diamond containing a question mark. </span><span style="font-size:12pt">That
leads to login failures. </span><br>
</div>
</blockquote>
<p><br>
</p>
<p>That result seems not correct if it's emitting a "<span style="font-size:12pt">diamond containing a question mark". </span></p>
<p><span style="font-size:12pt"><br>
</span></p>
<p><span style="font-size:12pt">I was typing on my phone and wasn't in a position to type the unicode character, but here it is: <span style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 14.6667px; display: inline !important; color: rgb(14, 16, 26); background-color: rgb(255, 255, 255);">�</span></span></p>
<div dir="auto"></div>
<p><span style="font-size:12pt">You didn't mention the outbound binding, but assuming it's POST, that ought to come out as HTML-encoded. However...</span><br>
</p>
<p><span style="font-size:12pt"><br>
</span></p>
<p>POST</p>
</div>
<div dir="auto">If the SP is actually sending the JSON as a literal JSON string, then that's unwise, for this exact reason. </div>
<div dir="auto"><br>
</div>
<div dir="auto">Indeed,it is, as I wrote in my original message. It's not a hypothetical. It's a matter of fact.</div>
<div dir="auto"><br>
</div>
<div dir="auto">A better approach would be to encode it so that it is a completely URL- or HTML-safe string, so that no party will mutate it and cause lack of fidelity with the original data. Base64 (or really Base64URL) would be a good choice. </div>
<div dir="auto"><br>
</div>
<div dir="auto">Of course.</div>
<div dir="auto"><br>
</div>
<div dir="auto">If you want to go to these 2 vendors and ask them to fix something, that seems the more bulletproof approach. But see below for the actual requirements. JSON - encoded or not - is quite possibly too large.<br>
</div>
<div dir="auto">
<p><br>
</p>
<blockquote type="cite">
<div dir="auto"><span style="font-size:12pt"><br>
</span></div>
<div dir="auto"><span style="font-size:12pt">Shibboleth version 4.0.1 allowed unusual Relay State parameters such as JSON dictionaries--perhaps I overlooked a configuration I should have set.</span></div>
</blockquote>
<p><br>
</p>
<p>We try to adhere to the spec. </p>
<p><br>
</p>
<blockquote type="cite">
<div dir="auto"><span style="font-size:12pt"><br>
</span></div>
</blockquote>
<p><br>
</p>
<p></p>
<p>The other requirement though is that it is limited to 80 bytes in size (RFC "MUST NOT" exceed). An arbitrary JSON object could easily violate that. I'd check what they are actually sending </p>
<p>I have. I'm not including it here.</p>
<p>and if they're over that limit, you can point out that that is a clear spec violation.</p>
<p>Ok. One is over the 80 byte limit, one is under. Both send JSON dictionaries.</p>
<p>If you want all the details, look at the SAML 2.0 Bindings spec doc. Section 3.4.3 is for the Redirect binding and 3.5.3 is for POST binding (but they're basically identical).<br>
</p>
<p><br>
</p>
<blockquote type="cite">
<div dir="auto"><span style="font-size:12pt"><span> How common is sending JSON through the Relay <span>State?
<br>
</span></span></span></div>
</blockquote>
<p><br>
</p>
<p>I doubt it's common and I personally haven't ever seen or heard of a vendor doing it.</p>
<p>I am aware of two.</p>
<p><br>
</p>
<p>But it's not technically disallowed as far as I know, as long as it's under the 80 byte limit. But it's probably not the wisest approach.<br>
</p>
</div>
<div dir="auto">It's possible that <span style="font-size: 12pt;">Oracle over-interpreted the spec. Thanks for your reply.</span></div>
<br>
</div>
</body>
</html>