Authn request w/ isPassive=true does not work with Shibboleth IdP 2.3.6

[Takeshi NISHIMURA]

Dear all,

I have a problem about authn request with isPassive=true on Shibboleth IdP 2.3.6.
If a browser has no session on the IdP, the request stops at the IdP with this error message:
> Error Message: Error decoding authentication request message
Logs are attached below.

Maybe the cause of this problem is:
https://issues.shibboleth.net/jira/browse/SIDP-549

Sincerely,
Takeshi

23:42:04.858 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:239] - Redirecting user to authentication engine at https://HOSTNAME:443/idp/AuthnEngine
23:42:04.917 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:209] - Processing incoming request
23:42:04.917 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:240] - Beginning user authentication process.
23:42:04.917 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:283] - Filtering configured LoginHandlers: {urn:oasis:names:tc:SAML:2.0:ac:classes:PreviousSession=edu.internet2.mi
ddleware.shibboleth.idp.authn.provider.PreviousSessionLoginHandler at de24c5, urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport=edu.internet2.middleware.shibboleth.idp.authn.provider.Username
PasswordLoginHandler at 402e11}
23:42:04.917 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:332] - Filtering out previous session login handler because there is no existing IdP session
23:42:04.917 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:427] - Passive authentication is required, filtering poassible login handlers accordingly.
23:42:04.918 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:442] - Authentication handlers remaining after passive authentication requirement filtering: {}
23:42:04.918 - WARN [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:446] - Passive authentication required but no login handlers available to support it
23:42:04.918 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:161] - Returning control to profile handler
23:42:04.918 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:177] - Redirecting user to profile handler at https://HOSTNAME:443/idp/profile/SAML2/Redirect/SSO
23:42:04.954 - INFO [Shibboleth-Access:74] - 20120621T144204Z|IPADDRESS|HOSTNAME:443|/profile/SAML2/Redirect/SSO|
23:42:04.955 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.IdPProfileHandlerManager:86] - shibboleth.HandlerManager: Looking up profile handler for request path: /SAML2/Redirect/SSO
23:42:04.955 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.IdPProfileHandlerManager:97] - shibboleth.HandlerManager: Located profile handler of the following type for the request path: edu.inte
rnet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler
23:42:04.955 - DEBUG [edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:574] - Unbinding LoginContext
23:42:04.955 - DEBUG [edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:600] - Expiring LoginContext cookie
23:42:04.955 - DEBUG [edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:611] - Removed LoginContext, with key 33557650-8be0-4406-a282-29d7324d6a46, from StorageService partition loginContexts
23:42:04.955 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:170] - Incoming request contains a login context but principal was not authenticated, processing first leg of 
request
23:42:04.956 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:339] - Decoding message with decoder binding 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect'
23:42:04.956 - DEBUG [org.opensaml.saml2.binding.decoding.HTTPRedirectDeflateDecoder:90] - Decoded RelayState: null
23:42:04.993 - WARN [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:373] - Error decoding authentication request message
org.opensaml.ws.message.decoder.MessageDecodingException: No SAMLRequest or SAMLResponse query path parameter, invalid SAML 2 HTTP Redirect message
        at org.opensaml.saml2.binding.decoding.HTTPRedirectDeflateDecoder.doDecode(HTTPRedirectDeflateDecoder.java:98) ~[opensaml-2.5.3.jar:na]
(snip)