help with error processing SAML request to IdP

IAM David Bantz dabantz at alaska.edu
Thu Sep 29 09:26:35 EDT 2016 

Request sent by POST or GET

*POST https://idp.alaska.edu/idp/profile/SAML2/Redirect/SSO
<https://idp.alaska.edu/idp/profile/SAML2/Redirect/SSO> *

*GET https://idp.alaska.edu/idp/profile/SAML2/Redirect/SSO
<https://idp.alaska.edu/idp/profile/SAML2/Redirect/SSO>*

produces the same IdP error decoding the request, presumably very
early in processing of incoming request:

05:17:51.517 - INFO [Shibboleth-Access:73] -
20160929T131751Z|137.229.112.89|idp.alaska.edu:443|/profile/SAML2/Redirect/SSO|
> 05:17:51.519 - ERROR [org.opensaml.ws.message.decoder.BaseMessageDecoder:208] - Encountered error parsing message into its DOM representation
> org.opensaml.xml.parse.XMLParserException: Unable to read XML from input stream
>         at org.opensaml.xml.parse.StaticBasicParserPool.parse(StaticBasicParserPool.java:237) ~[xmltooling-1.4.0.jar:na]
>         at org.opensaml.ws.message.decoder.BaseMessageDecoder.unmarshallMessage(BaseMessageDecoder.java:186) [openws-1.5.0.jar:na]
>         at org.opensaml.saml2.binding.decoding.HTTPRedirectDeflateDecoder.doDecode(HTTPRedirectDeflateDecoder.java:102) [opensaml-2.6.0.jar:na]
>         at org.opensaml.ws.message.decoder.BaseMessageDecoder.decode(BaseMessageDecoder.java:79) [openws-1.5.0.jar:na]
>         at org.opensaml.saml2.binding.decoding.BaseSAML2MessageDecoder.decode(BaseSAML2MessageDecoder.java:70) [opensaml-2.6.0.jar:na]
>         at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.decodeRequest(SSOProfileHandler.java:386) [shibboleth-identityprovider-2.4.0.jar:na]
>         at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.performAuthentication(SSOProfileHandler.java:211) [shibboleth-identityprovider-2.4.0.jar:na]
>         at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:184) [shibboleth-identityprovider-2.4.0.jar:na]
>         at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:90) [shibboleth-identityprovider-2.4.0.jar:na]
>         at edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet.service(ProfileRequestDispatcherServlet.java:83) [shibboleth-common-1.4.0.jar:na]
>         at javax.servlet.http.HttpServlet.service(HttpServlet.java:717) [servlet-api.jar:na]
>         at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) [catalina.jar:6.0.32]
>         at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.32]
>         at edu.internet2.middleware.shibboleth.idp.util.NoCacheFilter.doFilter(NoCacheFilter.java:50) [shibboleth-identityprovider-2.4.0.jar:na]
>         at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:6.0.32]
>         at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.32]
>         at edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter.doFilter(IdPSessionFilter.java:87) [shibboleth-identityprovider-2.4.0.jar:na]
>         at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:6.0.32]
>         at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.32]
>         at edu.internet2.middleware.shibboleth.common.log.SLF4JMDCCleanupFilter.doFilter(SLF4JMDCCleanupFilter.java:52) [shibboleth-common-1.4.0.jar:na]
>         at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:6.0.32]
>         at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.32]
>         at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) [catalina.jar:6.0.32]
>         at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191) [catalina.jar:6.0.32]
>         at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127) [catalina.jar:6.0.32]
>         at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) [catalina.jar:6.0.32]
>         at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:554) [catalina.jar:6.0.32]
>         at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) [catalina.jar:6.0.32]
>         at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:298) [catalina.jar:6.0.32]
>         at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:859) [tomcat-coyote.jar:6.0.32]
>         at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:588) [tomcat-coyote.jar:6.0.32]
>         at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489) [tomcat-coyote.jar:6.0.32]
>         at java.lang.Thread.run(Thread.java:682) [na:1.6.0_111]
> Caused by: java.util.zip.ZipException: oversubscribed dynamic bit lengths tree
>         at java.util.zip.InflaterInputStream.read(InflaterInputStream.java:147) ~[na:1.6.0_111]
>         at java.util.zip.InflaterInputStream.read(InflaterInputStream.java:105) ~[na:1.6.0_111]
>         at org.apache.xerces.impl.XMLEntityManager$RewindableInputStream.readAndBuffer(Unknown Source) ~[na:na]
>         at org.apache.xerces.impl.XMLEntityManager.setupCurrentEntity(Unknown Source) ~[na:na]
>         at org.apache.xerces.impl.XMLVersionDetector.determineDocVersion(Unknown Source) ~[na:na]
>         at org.apache.xerces.parsers.XML11Configuration.parse(Unknown Source) ~[na:na]
>         at org.apache.xerces.parsers.XML11Configuration.parse(Unknown Source) ~[na:na]
>         at org.apache.xerces.parsers.XMLParser.parse(Unknown Source) ~[na:na]
>         at org.apache.xerces.parsers.DOMParser.parse(Unknown Source) ~[na:na]
>         at org.apache.xerces.jaxp.DocumentBuilderImpl.parse(Unknown Source) ~[na:na]
>         at javax.xml.parsers.DocumentBuilder.parse(Unknown Source) ~[na:1.4.01]
>         at org.opensaml.xml.parse.StaticBasicParserPool$DocumentBuilderProxy.parse(StaticBasicParserPool.java:649) ~[xmltooling-1.4.0.jar:na]
>         at org.opensaml.xml.parse.StaticBasicParserPool.parse(StaticBasicParserPool.java:232) ~[xmltooling-1.4.0.jar:na]
>         ... 32 common frames omitted
>

On Thu, Sep 29, 2016 at 9:07 AM, Peter Schober <peter.schober at univie.ac.at>
wrote:

> * IAM David Bantz <db at alaska.edu> [2016-09-29 14:55]:
> > Here's the SAML request as presented in Firefox SAML Tracer:
>
> That representation is probably useless to debug problems with actual
> on-the-wire protocol messages.
>
> > and the error in Shib IdP process log:
> >
> > 04:36:39.849 - ERROR
> > [org.opensaml.ws.message.decoder.BaseMessageDecoder:208] - Encountered
> > error parsing message into its DOM representation
> > > org.opensaml.xml.parse.XMLParserException: Unable to read XML from
> input stream
> > >
> > >         at org.opensaml.xml.parse.StaticBasicParserPool.parse(
> StaticBasicParserPool.java:237) ~[xmltooling-1.4.0.jar:na]
> > > ...
> > >
> > > Caused by: java.util.zip.ZipException: oversubscribed dynamic bit
> lengths tree
>
> I'm not familiar with that error and you're not really providing
> sufficient co(n)text, but how/where did your IDP recieve the authn
> request?
> If there were a mismatch (e.g. POST to your Redirect endpoint) I guess
> the IDP would have failed (and complained) differently but it might
> still be instructive to know the specifics.
> -peter
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160929/0bf41972/attachment-0001.html>

More information about the users mailing list