The reason is that IIS does indeed limit the size of the URLs in the requests, and returns a 404 error to the client if the URL exceeds this size. The maximum size IIS allows is 2048 bytes, but lower values can be configured, and I guess this is what OutSystems does.

https://docs.microsoft.com/en-us/iis/configuration/system.webserver/security/requestfiltering/requestlimits/

A workaround for this is to use post requests, which will move the parameters from the URL to the header, but note that even then IIS still limits to the header size to 16384 bytes, and will also return a 404 error to the client if you exceed this limit. Also, as for URLs, the maximum header size can be configured to less than the IIS limit.

Hi all,

May I know how to configure the [IDP] forge or ADFS to send SAMLRepsonse by POST method?

Thank in advance.

In order to increase the max query string in Outsystems, you can use the Factory Configuration component to create a shared configuration and apply it to the module that has the screen that needed to receive the larger URL.

You can find below the shared configuration template:

<?xml version="1.0" encoding="UTF-8"?>
<xsl:stylesheet version="1.0" 
    xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
    <xsl:output method="xml" indent="yes" encoding="UTF-8"/>
    <xsl:template match="@*|node()">
        <xsl:copy>
            <xsl:apply-templates select="@*|node()"/>
        </xsl:copy>
    </xsl:template>
    <xsl:template match="/configuration/system.webServer/security/requestFiltering">
        <xsl:copy>
            <xsl:apply-templates select="@*|node()"/>
            <requestLimits maxUrl="3000" maxQueryString="3000"/>
        </xsl:copy>
    </xsl:template>
</xsl:stylesheet>

On the example, I'm using 3000 chars for the maxURL and 3000 for the QueryString. Feel free to adjust as per your requirements.

Regards,

Mauro Machado wrote:

It is absolutely the configuration of server, there are some ways to fix it

1. increase the request length in configuration on server. but if your data is larger, u will get the same error
2. try to use POST and specify data in body
3. can make a weird GET api which accept header, url and body

If I was in this case, I will choose option 2, it makes 

• my url clean and keep user away from nonsense data on the address bar
• I can stay safe from the data length

I also want to use POST method. However, I don't how to configure ADFS to response logout in POST method.

Any ideas?

In our case, we were getting error in maxQueryStringLength parameter.

"The length of the query string for this request exceeds the configured maxQueryStringLength value"

So we had to change the httpruntime settings in shared configuration under Factory Configuration.

<xsl:template match="/configuration/system.web/httpRuntime">
<xsl:copy>
<xsl:attribute name="maxQueryStringLength">REPLACE_WITH_VALUE_HERE</xsl:attribute>
<xsl:attribute name="maxUrlLength">REPLACE_WITH_VALUE_HERE</xsl:attribute>
</xsl:copy>
</xsl:template>

Thank for your information.

It's solved