Troubleshooting the "Unable to decode" (IdP 3.3)

[Andrew Morgan]

On Fri, 25 Aug 2017, O'Dowd, Josh wrote:

> We are getting a regular stream of bad requests, from a specific IP 
> subnet range, which are logging the "Unable to decode" and "Cannot 
> Unmarshall XML" errors.  I have tried tuning up the log level for 
> opensaml and for messages, but I can only get the IP address.  It 
> appears 'messages' logger only debugs out valid messages and not invalid 
> ones; I assume for good reason.
>
> Is there any known way to get a look at these incoming SAML requests 
> without knowing what entity is, only that the subnet is registered to 
> Facebook?

If you have the SAMLRequest parameter, you can do these steps:

1. URL-decode the parameter's value
2. base64 decode and inflate

I use the online tools here (click on Code/Decode):

   https://www.samltool.com/online_tools.php

 	Andy