Error decoding authentication request message

[Cantor, Scott]

Please use the OASIS saml-dev list for any follow up, as these are not
Shibboleth questions.


On 10/17/14, 3:05 PM, "Mark Hunt" <mhunt at boardeffect.com> wrote:

>When sending the following xml, base64 encoded, I¹m getting Error
>decoding authentication request message from the IdP and I¹m not sure
>why. The request is compressed, would the IdP have trouble decoding then
>inflating the request?

Your message says it's a POST binding request. The POST binding does not
involve compression. So it would be illegal for you to do that.
Compression is only part of the Redirect binding.

I can see these issues that go beyond the encoding:

><samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
>ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-REDIRECT"

That is not the correct constant for that binding, and even if it were,
SSO responses cannot be delivered with that binding, only POST or
Artifact. So that's wrong, and will be rejected by the IdP later.

>   <samlp:NameIDPolicy
>Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
>AllowCreate="true" />

Do you really require that format? If not, don't ask for it.

>   <samlp:RequestedAuthnContext Comparison="exact">
>      <saml:AuthnContextClassRef
>xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">urn:oasis:names:tc:SAML
>:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef>
>   </samlp:RequestedAuthnContext>

You really won't accept methods other than that? Like say a multi-factor
authentication? If not, don't ask for that.

-- Scott