IdP unable to parse SP authN request

David Bantz dabantz at alaska.edu
Wed May 15 15:47:00 EDT 2013


Attempting to support vendor use of our Shibboleth IdP for authN, the IdP is unable to parse the request from the vendor.
I haven't seen this particular error and would appreciate any guidance.

IdP log excerpt:

15:33:45.491 - DEBUG [org.opensaml.saml2.binding.decoding.HTTPRedirectDeflateDecoder:126] - Base64 decoding and inflating SAML message
15:33:45.492 - DEBUG [org.opensaml.ws.message.decoder.BaseMessageDecoder:182] - Parsing message stream into DOM document
15:33:45.495 - ERROR [org.opensaml.ws.message.decoder.BaseMessageDecoder:207] - Encountered error parsing message into its DOM representation
org.opensaml.xml.parse.XMLParserException: Unable to read XML from input stream
…
Caused by: java.util.zip.ZipException: oversubscribed dynamic bit lengths tree

Vendor-provided example of the authN request:

<samlp:AuthnRequest ID="_ef64d45f-4fde-485d-bd20-e864c9a94a38" Version="2.0" IssueInstant="2013-05-15T18:49:56.249Z" Destination="http://localhost/SSO_STS/Login.aspx" ForceAuthn="false" IsPassive="false" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" AssertionConsumerServiceURL="http://localhost/SAML/" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
  <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">http://localhost</saml:Issuer>
  <Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
    <SignedInfo>
      <CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
      <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
      <Reference URI="#_ef64d45f-4fde-485d-bd20-e864c9a94a38">
        <Transforms>
          <Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
          <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
            <InclusiveNamespaces PrefixList="#default samlp saml ds xs xsi" xmlns="http://www.w3.org/2001/10/xml-exc-c14n#" />
          </Transform>
        </Transforms>
        <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
        <DigestValue>0Bzil/H6ltTS+fEqthd7fBpzrGM=</DigestValue>
      </Reference>
    </SignedInfo>
    <SignatureValue>fCEsvFW7VdlVFAvcp971ZbHBmX1DtqgAXAJSCH0OlOABL0TAhjwJAc35giuo/kc7x4EbNApR8LO2btcUYJ8N3pr/p9jtobd0gc7+vM/wSeXUIoWKrZohXVi3Y+6SVAJ6gutPfbdEUdoC8f+DMfzBD8XB+CXVJonRfE5h62r08MQ=</SignatureValue>
    <KeyInfo>
      <X509Data>
        <X509Certificate>MIIBnjCCAQcCBEbTmdAwDQYJKoZIhvcNAQEEBQAwFjEUMBIGA1UEAxMLd3d3LmlkcC5jb20wHhcNMDcwODI4MDM0MzEyWhcNMTcwODI1MDM0MzEyWjAWMRQwEgYDVQQDEwt3d3cuaWRwLmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAo31q3mJZayXfZkLDuLcnanc/KG+RDFW+OlYDP+RubvWnt8X5jtiUTcp8IQ46TNEUFskmsonUb5AnG+zOCcawb2dJr8kBtCNhfi/TufZGBQNjuAxNMi34yIgRdGinaznHgclrAIIZTyKerQqYjPL1xRDsFGpzqGGi/2opzN8nV5kCAwEAATANBgkqhkiG9w0BAQQFAAOBgQBmNwFN+98aybuQKFJFr69s9BvBVYtk+Hsx3gx0g4e5sLTlkcSU03XZ8AOet0my4RvUspaDRzDrv+gEgg7gDP/rsVCSs3dkuYuUvuWbiiTq/Hj4EKuKZa8nIerZ3Oz4Xa1/bK88eT7RVsv5bMOxgJbSEvTidTvOpV0G13duIqyrCw==</X509Certificate>
      </X509Data>
    </KeyInfo>
  </Signature>
  <samlp:NameIDPolicy AllowCreate="true" />
</samlp:AuthnRequest>


More information about the users mailing list