search

picketlink2 / federation

PicketLink v2.1.x Federation. PicketLink v2.5.x onwards is hosted at https://github.com/picketlink
http://www.picketlink.org
14 stars 29 forks source link

Avoid unmatched SAMLRequestMessage and bindingProfile #158

Closed junxiong closed 11 years ago

junxiong commented 11 years ago

SAML request message is stored in session for later usage, but the binding type is got from current request every time.

This may introduce a possibility which cause the IDPWebRequestUtil instance to deal with a original post binding SAML request message as redirect binding. Since the format of the message between posting and redirect binding is different, the request message can not be pared correctly.

pedroigor commented 11 years ago

Hi,

First of all, we really appreciate your help. And sorry for the late response. 

We had some changes to the IDP valve logic that makes quite difficult to merge your PR. Also, I think we have this issue already fixed in upstream.

Can you check this out ? If it is not fixed, can you send another PR considering the latest changes from upstream/master ?

Thanks.

junxiong commented 11 years ago

We have merge code against upstream. But we find another issue, Which still existed on upstream. We are trying to improve the look and feel for the home page of identity provider, that say, we add some images and external css and java script files. But we failed, because every request to identity provider will be dispatched to "/host" after log in identity provider. We have modified AbstractIDPValve to fix this issue.

junxiong commented 11 years ago

Thanks, I'd noticed it on the master branch, I will try it.

junxiong commented 11 years ago

Confirmed, this issue no longer existed on 2.1.8 snapshot. I will close this pull request.