<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
> And in that case, the IdP is supposed to send the RelayState back to the SP verbatim, if I<br>
> understand Scott correctly.<br>
<br>
Not verbatim, because URL encoding isn't canonical. Multiple encoded strings can decode to the same value. As an example, both '+' and '%20' are used to denote spaces, but either is allowed. The string may be different at both steps because the encoding process
is different, but the decoded value has to be the same in the end or somebody did it wrong.<br>
<br>
For the sake of accuracy, the issue where '+' and '%20' both decode to a space character reflects non-injectivity in the encoding scheme—different encodings leading to the same decoded value. This is distinct from non-canonicity, which would involve variations
in standard representation. But other than that, point taken.<br>
<br>
> Before I head off to saml-dev about the OASIS spec, there seem to be three takes on the<br>
> matter.<br>
<br>
There really aren't, and the errata doesn't enter into it. The errata has to do with SPs protecting themselves in their usage of the field, it has no bearing on the actual requirement on the IdP to be 100% faithful in returning the value.<br>
<br>
--Scott</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
OK, I'll let Oracle know. </div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Many thanks!</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Florian<br>
<br>
</div>
</body>
</html>