John Dennis b1301e606d Use comma as separator in ECP Accept HTTP header ... During SAML ECP authentication 2 specially formatted HTTP headers *MUST* be included in the request in order for the SP (Service Provider) to recognize the client is ECP capable and to start the SAML ECP flow. One is the PAOS header and the other is the Accept header which must include the "application/vnd.paos+xml" media type. Media types in the Accept header are separated by a comma (,). Unfortunately keystoneauth uses a semicolon (;) as the media type separator. The HTTP spec reserves the semicolon in the Accept header to attach parameters to the media type. For example Accept: type1;params1,type2;params2 Using a semicolon as a media type separator is syntactically invalid and can cause failures in servers that parse the Accept header. For example mod_auth_mellon emits this error message and fails to process the ECP request: request supplied valid PAOS header but omitted PAOS media type in Accept header have_paos_media_type=False valid_paos_header=True is_paos=False This indicates only 1 of the 2 required conditions were met. Change-Id: I6469990a57762fc47b297d7b5b2b4cb4872df4ba Signed-off-by: John Dennis <jdennis@redhat.com> Closes-Bug: 1656946		2017-01-16 16:50:09 -05:00
..
__init__.py	Correctly report available for ADFS plugin	2016-07-30 23:53:13 -05:00
adfs.py	Correctly report available for ADFS plugin	2016-07-30 23:53:13 -05:00
base.py	Correctly report available for ADFS plugin	2016-07-30 23:53:13 -05:00
saml2.py	Use comma as separator in ECP Accept HTTP header	2017-01-16 16:50:09 -05:00