SAMLRequest Encoding for POST Versus REDIRECT Binding

Products

• CA Single Sign On Federation (SiteMinder)

Issue/Introduction

Performed a SAML integration with a 3^rd party using HTTP-Redirect Authentication Request Binding.

The SAMLRequest query parameter that is sent in the redirect is URL encoded, base64 encoded, but not XML deflated (compressed). 

Sample data is given below.  The following error occurs in the FWSTrace.log for this request:

[04/27/2021][12:06:06][88767][95966976][<Transaction ID>][SSO.java][doGet][Transaction with ID: <Transaction ID> failed. Reason: BAD_SAML_REQUEST_ENCODING]

From this link below, it appears that XML deflation is required when encoding the SAMLRequest query parameter for HTTP-Redirect binding.

HTTP Status 400 - Bad Request with Error messasge BAD_SAML_REQUEST_ENCODING

From the above document, GET(REDIRECT) encoding,  which uses the DEFLATE compression method, its output will be accepted by CA SSO in HTTP GET.

Please confirm whether XML deflation is required in the encoding of the SAMLRequest query parameter or not? 

Environment

Release : 12.8.xx and 12.9 (Applicable to all the supported releases)
Component : SiteMinder Federation(Federation Manager)

Resolution

For POST binding, Siteminder expects the SAMLRequest to be Base64 encoded. 

For REDIRECT binding, the expectation is for Base64 and Deflate encoding.