Produits Entr'ouvert » Authentic 2

Hello,

Here is the configuration :

IDP : Authentic
SP : my SAML 2.0 Server

My SP server initiated a HTTP-POST AuthnRequest with a "RelayState" to Authentic (IDP), and after some debugging I figured out that Authentic doesn't forward the RelayState.

Here is my debugging trace in the return_saml2 function (saml2/common.py) :

/usr/local/lib/python2.7/dist-packages/authentic2/saml/common.py(171)return_saml()

-> 'relay_state': profile.msgRelayState},
(Pdb) p profile.msgRelayState
None
(Pdb) p request._get_post()['RelayState']
u'LCkji5FkDJ2dDYe3oHh53uoYID00B'

I made a little work around :

• common.py 2012-03-06 14:23:07.941738320 +0100
  --- common_patch.py 2012-03-07 09:10:45.181745846 +0100 *******
• 166,172 **
  'url': profile.msgUrl,
  'fieldname': field_name,
  'body': profile.msgBody,
  ! 'relay_state': profile.msgRelayState },
  context_instance=context_instance)
  return HttpResponse(profile.msgBody, mimetype = 'text/xml')
  elif profile.msgUrl:
  --- 166,172 ----
  'url': profile.msgUrl,
  'fieldname': field_name,
  'body': profile.msgBody,
  ! 'relay_state': request._get_post()['RelayState']},
  context_instance=context_instance)
  return HttpResponse(profile.msgBody, mimetype = 'text/xml')
  elif profile.msgUrl:

According to the SAML2 norm, for a HTTP-POST AuthnRequest : ( http://docs.oasis-open.org/security/saml/v2.0/saml-bindings-2.0-os.pdf p 22 ) :

If a SAML request message is accompanied by RelayState data, then the SAML responder MUST return its SAML protocol response using a binding that also supports a RelayState mechanism, and it MUST place the exact data it received with the request into the corresponding RelayState parameter in the response.

What do you think about it ? Did I miss something ?

Regards