IdP unable to parse SP authN request
David Bantz
dabantz at alaska.edu
Wed May 15 15:47:00 EDT 2013
Attempting to support vendor use of our Shibboleth IdP for authN, the IdP is unable to parse the request from the vendor.
I haven't seen this particular error and would appreciate any guidance.
IdP log excerpt:
15:33:45.491 - DEBUG [org.opensaml.saml2.binding.decoding.HTTPRedirectDeflateDecoder:126] - Base64 decoding and inflating SAML message
15:33:45.492 - DEBUG [org.opensaml.ws.message.decoder.BaseMessageDecoder:182] - Parsing message stream into DOM document
15:33:45.495 - ERROR [org.opensaml.ws.message.decoder.BaseMessageDecoder:207] - Encountered error parsing message into its DOM representation
org.opensaml.xml.parse.XMLParserException: Unable to read XML from input stream
…
Caused by: java.util.zip.ZipException: oversubscribed dynamic bit lengths tree
Vendor-provided example of the authN request:
<samlp:AuthnRequest ID="_ef64d45f-4fde-485d-bd20-e864c9a94a38" Version="2.0" IssueInstant="2013-05-15T18:49:56.249Z" Destination="http://localhost/SSO_STS/Login.aspx" ForceAuthn="false" IsPassive="false" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" AssertionConsumerServiceURL="http://localhost/SAML/" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
<saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">http://localhost</saml:Issuer>
<Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
<SignedInfo>
<CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
<SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
<Reference URI="#_ef64d45f-4fde-485d-bd20-e864c9a94a38">
<Transforms>
<Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
<Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
<InclusiveNamespaces PrefixList="#default samlp saml ds xs xsi" xmlns="http://www.w3.org/2001/10/xml-exc-c14n#" />
</Transform>
</Transforms>
<DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
<DigestValue>0Bzil/H6ltTS+fEqthd7fBpzrGM=</DigestValue>
</Reference>
</SignedInfo>
<SignatureValue>fCEsvFW7VdlVFAvcp971ZbHBmX1DtqgAXAJSCH0OlOABL0TAhjwJAc35giuo/kc7x4EbNApR8LO2btcUYJ8N3pr/p9jtobd0gc7+vM/wSeXUIoWKrZohXVi3Y+6SVAJ6gutPfbdEUdoC8f+DMfzBD8XB+CXVJonRfE5h62r08MQ=</SignatureValue>
<KeyInfo>
<X509Data>
<X509Certificate>MIIBnjCCAQcCBEbTmdAwDQYJKoZIhvcNAQEEBQAwFjEUMBIGA1UEAxMLd3d3LmlkcC5jb20wHhcNMDcwODI4MDM0MzEyWhcNMTcwODI1MDM0MzEyWjAWMRQwEgYDVQQDEwt3d3cuaWRwLmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAo31q3mJZayXfZkLDuLcnanc/KG+RDFW+OlYDP+RubvWnt8X5jtiUTcp8IQ46TNEUFskmsonUb5AnG+zOCcawb2dJr8kBtCNhfi/TufZGBQNjuAxNMi34yIgRdGinaznHgclrAIIZTyKerQqYjPL1xRDsFGpzqGGi/2opzN8nV5kCAwEAATANBgkqhkiG9w0BAQQFAAOBgQBmNwFN+98aybuQKFJFr69s9BvBVYtk+Hsx3gx0g4e5sLTlkcSU03XZ8AOet0my4RvUspaDRzDrv+gEgg7gDP/rsVCSs3dkuYuUvuWbiiTq/Hj4EKuKZa8nIerZ3Oz4Xa1/bK88eT7RVsv5bMOxgJbSEvTidTvOpV0G13duIqyrCw==</X509Certificate>
</X509Data>
</KeyInfo>
</Signature>
<samlp:NameIDPolicy AllowCreate="true" />
</samlp:AuthnRequest>
More information about the users
mailing list