Shib IDP/ECP and input error

[Edwards, Wendy A]

After configuring Shib IDP 3.0 with idp.authn.flows=RemoteUserInternal and
using Apache to protect the /idp/profile/SAML2/SOAP/ECP endpoint, I ran
the simple testecp.sh script at http://www.cilogon.org/ecp (which had
worked with IDP 2) to test it.  The IDP returned a SOAP fault that
indicated that the server was not receiving XML input that made sense to
it.

<?xml version="1.0" encoding="UTF-8"?>
<soap11:Envelope 
xmlns:soap11="http://schemas.xmlsoap.org/soap/envelope/"><soap11:Body><soap
11:Fault><faultcode>soap11:Client</faultcode><faultstring>An error
occurred.</faultstring></soap11:Fault></soap11:Body></soap11:Envelope>


I ended up editing logback.xml to turn the log levels up to "debug" and
standing up the Shib3 IDP on my laptop and running it using the IntelliJ
IDE/debugger to see what was going on.  According to both the logs and the
debugger, the SOAP XML was received by the ECP endpoint.  Below is a
sample debug message from the log showing the input:

2015-04-26 22:52:37,251 - DEBUG
[org.springframework.webflow.engine.impl.FlowExecutionImpl:216] - Starting
in org.springframework.webflow.mvc.servlet.MvcExternalContext at 3107459 with
input map['<S:Envelope xmlns:S' ->
'"http://schemas.xmlsoap.org/soap/envelope/"
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"><S:Body><samlp:AuthnRequ
est xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
AssertionConsumerServiceURL="https://ec.ncsa.illinois.edu/Shibboleth.sso/SA
ML2/ECP" ID="_B27942A211E54BF7B21D8E129AD92770"
IssueInstant="2015-04-27T03:52:15"
ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS"
Version="2.0"><saml:Issuer
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://ec.ncsa.illinois
.edu/shibboleth</saml:Issuer><samlp:NameIDPolicy
AllowCreate="1"/><samlp:Scoping><samlp:IDPList><samlp:IDPEntry
ProviderID="https://wayward.ncsa.illinois.edu/idp/shibboleth"/></samlp:IDPL
ist></samlp:Scoping></samlp:AuthnRequest></S:Body></S:Envelope>']

The code threw an error when it tried to parse the SOAP XML code ‹ the
stack trace is below:
2015-04-26 22:52:46,038 - ERROR
[org.opensaml.messaging.decoder.servlet.BaseHttpServletRequestXMLMessageDec
oder:151] - Error unmarshalling message from input stream
net.shibboleth.utilities.java.support.xml.XMLParserException: Unable to
parse inputstream, it contained invalid XML
	at 
net.shibboleth.utilities.java.support.xml.BasicParserPool.parse(BasicParser
Pool.java:248)
Caused by: org.xml.sax.SAXParseException: Premature end of file.
	at 
com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.createSAXParseE
xception(ErrorHandlerWrapper.java:203)
2015-04-26 22:52:46,053 - ERROR
[org.opensaml.profile.action.impl.DecodeMessage:73] - Profile Action
DecodeMessage: Unable to decode incoming request
org.opensaml.messaging.decoder.MessageDecodingException: Error
unmarshalling message from input stream
	at 
org.opensaml.messaging.decoder.servlet.BaseHttpServletRequestXMLMessageDeco
der.unmarshallMessage(BaseHttpServletRequestXMLMessageDecoder.java:152)
Caused by: net.shibboleth.utilities.java.support.xml.XMLParserException:
Unable to parse inputstream, it contained invalid XML
	at 
net.shibboleth.utilities.java.support.xml.BasicParserPool.parse(BasicParser
Pool.java:248)
Caused by: org.xml.sax.SAXParseException: Premature end of file.
	at 
com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.createSAXParseE
xception(ErrorHandlerWrapper.java:203)


However, when I examined the input in the debugger, it was possible to
find the SOAP XML code (which appeared to be correct) associated with the
request.  Could there be any possibility that an InputStream is being
reused in the code somewhere?
(http://www.danielschneller.com/2008/01/saxparseexception-1-1-premature-end
-of.html) 

If this appears to simply be a misconfiguration somewhere on my end, I¹d
be happy to fix it and retry.  If it could be a code issue, I could look
for a workaround and report back.

Thanks,
Wendy