Partnership not working when SPID contains "&" chars

Products

• CA Single Sign-On
• CA Single Sign On Federation (SiteMinder)
• SITEMINDER
• CA Single Sign On Secure Proxy Server (SiteMinder)

Issue/Introduction

When Configuring Partnership and especially with EntityID (IdPID and SPID), a URL can be used as per documentation. When using special chars like "&", it is failing.

To illustrate, configuring the SPID format like:

https://sp.example.com/url.jsp?key=<key>&field=<name>&type=3

is failing.

Indeed, the Federation services fail to retrieve the Servide Provider ID until https://sp.example.com/url.jsp?key=<key>.

 

Resolution

Don't use the "&" in the SPID, as it is a special character part of a query string like "?".

Because the ampersand character "&" in the EntityID query string will be recognized as a separate query parameter.

The below Reference URL is more appropriate (1), which states:

1. An entity ID: 1) MUST be a URI, 2) SHOULD be an absolute URL, and 3) SHOULD NOT be a URN
2. The entity ID MUST be globally unique to avoid name collisions both within the Federation and across federations
3. If the entity ID is a URL (which is strongly RECOMMENDED), then:
   
   the host part of the URL MUST be a name rooted in the organization's Primary DNS Domain
   the URL MUST NOT contain a port number, a query string, or a fragment identifier

Recommended EntityID would be:

https://idp.example.com/idp
https://sp.example.com/sp

Invalid EntityID would be:

http://idp.example.com/affwebservices/public/saml2sso?SPID=http://sp.example.org?key=<key>&test=1
http://idp.example.com/affwebservices/public/saml2sso?SPID=http://sp.example.org?key=<key> (may work but not advisable to use)

 

Additional Information

 

1. Entity IDs