Partnership not working when SPID contains "&" chars
search cancel

Partnership not working when SPID contains "&" chars

book

Article ID: 35389

calendar_today

Updated On:

Products

CA Single Sign-On CA Single Sign On Federation (SiteMinder) SITEMINDER CA Single Sign On Secure Proxy Server (SiteMinder)

Issue/Introduction


When Configuring Partnership and especially with EntityID (IdPID and SPID), a URL can be used as per documentation. When using special chars like "&", it is failing.

To illustrate, configuring the SPID format like:

https://sp.example.com/url.jsp?key=<key>&field=<name>&type=3

is failing.

Indeed, the Federation services fail to retrieve the Servide Provider ID until https://sp.example.com/url.jsp?key=<key>.

 

Resolution


Don't use the "&" in the SPID, as it is a special character part of a query string like "?".

Because the ampersand character "&" in the EntityID query string will be recognized as a separate query parameter.

The below Reference URL is more appropriate (1), which states:

  1. An entity ID: 1) MUST be a URI, 2) SHOULD be an absolute URL, and 3) SHOULD NOT be a URN
  2. The entity ID MUST be globally unique to avoid name collisions both within the Federation and across federations
  3. If the entity ID is a URL (which is strongly RECOMMENDED), then:

    the host part of the URL MUST be a name rooted in the organization's Primary DNS Domain
    the URL MUST NOT contain a port number, a query string, or a fragment identifier

Recommended EntityID would be:

https://idp.example.com/idp
https://sp.example.com/sp

Invalid EntityID would be:

http://idp.example.com/affwebservices/public/saml2sso?SPID=http://sp.example.org?key=<key>&test=1
http://idp.example.com/affwebservices/public/saml2sso?SPID=http://sp.example.org?key=<key> (may work but not advisable to use)

 

Additional Information

 

  1. Entity IDs