Help request: "too many length or distance symbols" in authentication request

David Bantz dabantz at alaska.edu
Wed Feb 5 15:49:38 EST 2014 

Attempting to provide SSO for a vended hosted service using SAML in .net environment (Origami Risk),
Shibboleth IdP is unable to parse the authentication request.

The incoming SAML request according to the vendor is:

<?xml version="1.0" encoding="UTF-8"?><samlp:AuthnRequest ID="_4241073183472CBDEA1BB2FCE42AB2E2" Version="2.0" IssueInstant="2014-02-05T00:55:15Z" Destination="https://idp.alaska.edu/idp/profile/SAML2/Redirect/SSO" ForceAuthn="false" IsPassive="false" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" AssertionConsumerServiceURL="https://idp.alaska.edu/idp/profile/SAML2/Redirect/SSO" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
  <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://demo.origamirisk.com</saml:Issuer>
  <samlp:NameIDPolicy AllowCreate="true" />
</samlp:AuthnRequest>

The AssertionConsumerServiceURL seems bogus, but the IdP doesn’t seem to have gotten far enough to be bothered by that:

The IdP error log indicates inability to parse the XML, but is not helping me tell the vendor what to do differently:

10:59:22.562 - INFO [Shibboleth-Access:73] - 20140205T195922Z|69.121.192.240|idp.alaska.edu:443|/profile/SAML2/Redirect/SSO|
10:59:22.563 - ERROR [org.opensaml.ws.message.decoder.BaseMessageDecoder:207] - Encountered error parsing message into its DOM representation
org.opensaml.xml.parse.XMLParserException: Unable to read XML from input stream
        at org.opensaml.xml.parse.BasicParserPool.parse(BasicParserPool.java:220) ~[xmltooling-1.3.2.jar:na]
        at org.opensaml.ws.message.decoder.BaseMessageDecoder.unmarshallMessage(BaseMessageDecoder.java:185) [openws-1.4.2.jar:na]
        at org.opensaml.saml2.binding.decoding.HTTPRedirectDeflateDecoder.doDecode(HTTPRedirectDeflateDecoder.java:101) [opensaml-2.5.0.jar:na]
        at org.opensaml.ws.message.decoder.BaseMessageDecoder.decode(BaseMessageDecoder.java:78) [openws-1.4.2.jar:na]
        at org.opensaml.saml2.binding.decoding.BaseSAML2MessageDecoder.decode(BaseSAML2MessageDecoder.java:69) [opensaml-2.5.0.jar:na]
        at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.decodeRequest(SSOProfileHandler.java:331) [shibboleth-identityprovider-2.3.0.jar:na]
        at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.performAuthentication(SSOProfileHandler.java:189) [shibboleth-identityprovider-2.3.0.jar:na]
        at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:160) [shibboleth-identityprovider-2.3.0.jar:na]
        at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:87) [shibboleth-identityprovider-2.3.0.jar:na]
        at edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet.service(ProfileRequestDispatcherServlet.java:83) [shibboleth-common-1.3.0.jar:na]
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:717) [servlet-api.jar:na]
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) [catalina.jar:6.0.32]
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.32]
        at edu.internet2.middleware.shibboleth.idp.util.NoCacheFilter.doFilter(NoCacheFilter.java:49) [shibboleth-identityprovider-2.3.0.jar:na]
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:6.0.32]
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.32]
        at edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter.doFilter(IdPSessionFilter.java:80) [shibboleth-identityprovider-2.3.0.jar:na]
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:6.0.32]
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.32]
        at edu.internet2.middleware.shibboleth.common.log.SLF4JMDCCleanupFilter.doFilter(SLF4JMDCCleanupFilter.java:51) [shibboleth-common-1.3.0.jar:na]
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:6.0.32]
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.32]
        at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) [catalina.jar:6.0.32]
        at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191) [catalina.jar:6.0.32]
        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127) [catalina.jar:6.0.32]
        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) [catalina.jar:6.0.32]
        at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:554) [catalina.jar:6.0.32]
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) [catalina.jar:6.0.32]
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:298) [catalina.jar:6.0.32]
        at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:859) [tomcat-coyote.jar:6.0.32]
        at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:588) [tomcat-coyote.jar:6.0.32]
        at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489) [tomcat-coyote.jar:6.0.32]
        at java.lang.Thread.run(Thread.java:662) [na:1.6.0_45]
Caused by: java.util.zip.ZipException: too many length or distance symbols
…

The SAML post (also provided by the vendor) is:

<html xmlns="http://www.w3.org/1999/xhtml"><body onload="document.forms.theform.submit()"><noscript><p>Please press the Continue button to proceed.</p></noscript><form id="theform" action="https://idp.alaska.edu/idp/profile/SAML2/Redirect/SSO" method="post"><div><input type="hidden" name="SAMLRequest" value="PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48c2FtbHA6QXV0aG5SZXF1ZXN0IElEPSJfNDI0MTA3MzE4MzQ3MkNCREVBMUJCMkZDRTQyQUIyRTIiIFZlcnNpb249IjIuMCIgSXNzdWVJbnN0YW50PSIyMDE0LTAyLTA1VDAwOjU1OjE1WiIgRGVzdGluYXRpb249Imh0dHBzOi8vaWRwLmFsYXNrYS5lZHUvaWRwL3Byb2ZpbGUvU0FNTDIvUmVkaXJlY3QvU1NPIiBGb3JjZUF1dGhuPSJmYWxzZSIgSXNQYXNzaXZlPSJmYWxzZSIgUHJvdG9jb2xCaW5kaW5nPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YmluZGluZ3M6SFRUUC1QT1NUIiBBc3NlcnRpb25Db25zdW1lclNlcnZpY2VVUkw9Imh0dHBzOi8vaWRwLmFsYXNrYS5lZHUvaWRwL3Byb2ZpbGUvU0FNTDIvUmVkaXJlY3QvU1NPIiB4bWxuczpzYW1scD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOnByb3RvY29sIj48c2FtbDpJc3N1ZXIgeG1sbnM6c2FtbD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFzc2VydGlvbiI+aHR0cHM6Ly9kZW1vLm9yaWdhbWlyaXNrLmNvbTwvc2FtbDpJc3N1ZXI+PHNhbWxwOk5hbWVJRFBvbGljeSBBbGxvd0NyZWF0ZT0idHJ1ZSIgLz48L3NhbWxwOkF1dGhuUmVxdWVzdD4="/></div><noscript><div><input type="submit" value="Continue"/></div></noscript></form></body></html>


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140205/189ed42f/attachment-0001.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 163 bytes
Desc: Message signed with OpenPGP using GPGMail
Url : http://shibboleth.net/pipermail/users/attachments/20140205/189ed42f/attachment-0001.bin

More information about the users mailing list