Troubleshooting the "Unable to decode" (IdP 3.3)

[O'Dowd, Josh]

Thanks Andrew,

Very helpful!

Josh

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Andrew Morgan
Sent: Friday, August 25, 2017 11:58 AM
To: Shib Users <users at shibboleth.net>
Subject: Re: Troubleshooting the "Unable to decode" (IdP 3.3)

On Fri, 25 Aug 2017, O'Dowd, Josh wrote:

> We are getting a regular stream of bad requests, from a specific IP 
> subnet range, which are logging the "Unable to decode" and "Cannot 
> Unmarshall XML" errors.  I have tried tuning up the log level for 
> opensaml and for messages, but I can only get the IP address.  It 
> appears 'messages' logger only debugs out valid messages and not 
> invalid ones; I assume for good reason.
>
> Is there any known way to get a look at these incoming SAML requests 
> without knowing what entity is, only that the subnet is registered to 
> Facebook?

If you have the SAMLRequest parameter, you can do these steps:

1. URL-decode the parameter's value
2. base64 decode and inflate

I use the online tools here (click on Code/Decode):

   https://www.samltool.com/online_tools.php

 	Andy
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net