Message decoding error

[Wessel, Keith]

Thanks for that, Brent. Very handy tool, the saml2debugger in SSP, and way more screen reader friendly than SAML Trace or Firebug. The httpLiveHeaders plugin is also a nice tool for a screen reader user.

My SP’s SAML authn request looks complete to me:

<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="_685292b7f5c270d83cd3ae6c52e9a9996191791bfb" Version="2.0" IssueInstant="2016-03-08T02:44:01Z" Destination="https://shibboleth-test.techservices.illinois.edu/idp/profile/SAML2/POST/SSO" AssertionConsumerServiceURL="https://idpproxy-test.cites.illinois.edu/simplesaml/module.php/saml/sp/saml2-acs.php/default-sp" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"><saml:Issuer>https://idpproxy-test.cites.illinois.edu/simplesaml/module.php/saml/sp/metadata.php/default-sp</saml:Issuer><samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" AllowCreate="true"/><samlp:Scoping><samlp:RequesterID>https://shib-sp-dev.cites.illinois.edu/shibboleth</samlp:RequesterID></samlp:Scoping></samlp:AuthnRequest>

However, after the closing tag, there’s a lengthy string of garbage characters which seem to be extended ASCII. Is this ignored by the XML parser and the result of some padding, or could this be the problem?

Mark, you asked what I had for my auth source. It’s a pretty vanilla SSP SP configuration:
    'default-sp' => array(
        'saml:SP',
        'entityID' => null,
        'idp' => null,
        'discoURL' => null,
        'signature.algorithm' => 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256',
	'privatekey' => 'sp.key',
	'certificate' => 'sp.crt',
        'attributes' => array(
            'eduPersonPrincipalname' => 'urn:oid:1.3.6.1.4.1.5923.1.1.1.6',
        ),
    ),

Thought I’d start simple and go from there.

Any further thoughts?

Keith

From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Brent Putman
Sent: Monday, March 07, 2016 5:03 PM
To: users at shibboleth.net
Subject: Re: Message decoding error


On 3/7/16 5:54 PM, Wessel, Keith wrote:


Tom, I'd be happy to post the SAML authn request if I can get it. Turning upt he OpenSAML logging to DEBUG didn't seem to log it. Will I need to grab it with an SAML trace, or is there a way to make the IDP log it?

No, if the IdP (really OpenSAML) can't parse it, it doesn't currently log it.  Unless there's some Spring SWF support to log raw inbound HTTP requests, I haven't looked.

I guess the IdP *could* theoretically log the raw query/form params, but we've never done that since they are easy enough to get in other ways: 1) Firefox SAML Trace pluign 2) any browser tracing functionality to get the raw query/form params, then copy/past into the Feide SAML debugger. [1]

[1] https://rnd.feide.no/software/saml_2_0_debugger/