Troubleshooting the "Unable to decode" (IdP 3.3)

[O'Dowd, Josh]

Revisiting, from last week, we still have a persistent issue with these…

I finally was able to run a request from our httpd-access logs for a request where IdP erroring on the decoding.  I would really appreciate if someone could take a look at the error and the SAMLRequest parameter, decoded from the HTTPRequest that caused the error.  Is it the HTTPRequest that the inflater is calling “invalid”, or the SAMLRequest portion

The error:

ERROR [org.opensaml.profile.action.impl.DecodeMessage:73] - Profile Action DecodeMessage: Unable to decode
incoming requestorg.opensaml.messaging.decoder.MessageDecodingException: Error unmarshalling message from input stream
        at org.opensaml.messaging.decoder.servlet.BaseHttpServletRequestXMLMessageDecoder.unmarshallMessage(BaseHttpServletRequestXML
MessageDecoder.java:158)
Caused by: net.shibboleth.utilities.java.support.xml.XMLParserException: Unable to read data from input stream
        at net.shibboleth.utilities.java.support.xml.BasicParserPool.parse(BasicParserPool.java:251)
Caused by: java.util.zip.ZipException: invalid bit length repeat
        at java.util.zip.InflaterInputStream.read(InflaterInputStream.java:164)


The GET component of HTTPRequest from the httpd-access.log which caused the above error:

GET /idp/profile/SAML2/Redirect/SLO?RelayState=ss:m
em:05c0926ff5a1aeef48539ddd0327319f47958d23259d1b1892b0c4f033af647a&SAMLRequest=rVbZcqtIEn3XVzjUjwq72BeF7QhAC7skJKHlpYOlQCWxiQIh+PpG9
9rT190zE+6Jec3KPJnnZCbJK/bSpBibeZzXlQOvNcTV0z1NMjz+8fI2rMtsnHsY4XHmpRCPq2C8lixzTL0Q46LMqzzIk+HTpI9DmVehPHsbnqqqwGMAkjxG2UudVi8wrAEKC9
AHRCiB4IFAAQeGqIRBBdbmYvikTd6Gv3tRyDM8DHnSgz5DeELIcV7giZChYeQFfu+GcQ21DFdeVr0NKYLknwnhmSI2FDWmmDFJH4dPLizxj0r6Iofvrw8m4x9x5S/c/js1D2N
YPugM3z/pYOz/i8z6hHw/T2B1esE4fwW/pPiZrxhP7xXMHmXg91cPJ/lYwm0WnMo8y2v8UcfD/j2Jx/Be9e49wnMfMwTvP3N+TfOjimkWlG1RwVCb/C9sX+8wC/4EmXiV9wHz
ePjZ3F6MpmleGvolL2NAEQQJCAb0Xr3Hb8OnTVvAbzhOE5jCrBq+D77k7Kuwel3z8ElK4rxE1Sn9BpgHMcVyz4Ef9NoMXkM8NmCrZVH+UXyI/wMIAQjxARJiFP/2N/o9yD9k/
39hU2LvOfdg8ZzGEVkMfxKaoLjfsm+ifaGFTx45/GdCPEQE/5bIJ0EFFSdYPubjq8X1khq+r5Gh2H5jXEZBEHiuVM+B79x2hS+6KAaIWSxjCtRkY+8LQVf55ZGaj7qRamrEYY
4zwN5YM5meLGxttWQwAS5ilvasvG2gPdvNpKNBZjtsnWTRmRsqE9OYFFnlupHWd0SzTb1pU4udiibPgFIoU5yjemTEeL6g24G8YavC1RTOkCyCSgx9XRLumi2L66JbTvO0zep
Mke4dRN0MrHZgLrDbCtEicm/TNgjL2/zOk8YBXM6uPuhCWGkUpzaXDruFX04ZWRWgem4Yjtkuz8IEmZJz9XZkMq9sBaluOQm2UncskoMgOtcmY2TFvBm7jahaA+JeF+yRmZup
bSshbuqyHwlt5Z+1bXmlKNJy49NVenv7aMyvcg++2D6aAv42y/1X48/N+F4jGS28pbY6dZukaZ2zEROinjfK1SFc3jzrlqqMIkWX0mKa5qG9uHbKTCyS2Vxq/bnJgmVNmFzIZ
wbqMnrgqBk9mUUC19ykXLaSjt0GfsRrdpp2F0dfHnP1zIuWl1akfNtJa0/fbFuskNRVmM9FcqSf1Y1bkrPFDImD2uq6UwjSbVC4PiDJ484aARbt5KN4tLt2jU6laxtsDOVKnq
8Z6n5beLezdokOXnCoL2Z+T+JFvif3zroaNOTFivx7U9yL/v4cJTduJhxvryAR+BNHKyPGCRxma6z3FTPlnUY7XPPYNqYMi/WlqGf7wqNv16jl9tppoCWKoS7cliWlyabbLwv
BkO7TkbSX5kAt8nMT0KuZu5JTWfYavz0ndJZQ0eZQR0qsIaUVdC83JN1cXE/tAPGba7LNc0uPkz3eI0JV9MQ30mBinWkZFjtSOjAiks6ytF8eo34TkAFyeJKmOWiq7VqTjAuF
Y/MQ77WBKWxAGnoHGxWySMsqu+2aWzPjq5i3gnxnS2R689yMiFacc3WWe11IjsvIaEsDHjcjVNUsv6jw5QzazXQQqsDUaQlMZByuTkbJs6lmbVbXE60W83PVaN1+VSzt6YiDz
fdm9q8j+2H86137PLFriB+XT8tCeH//3RN9QqA4loW0J3CBwPE8wXEswQccFElIf17ML1Gfxi9/QO9/AA==&SigAlg=http://www.w3.org/2000/09/xmldsig HTTP/1.1
" 400 18603

jordan91

The SAMLRequest parameter value from the above HTTPRequest which caused the above error.  This was decoded using the http://rnd.feide.no/ SAML2 debugger tool:

<samlp:LogoutRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" Destination="https://{HOST}/idp/profile/SAML2/Redirect/SLO" ID="_afd747ed71aeb40a8d66aca9e43efacb" IssueInstant="2017-08-20T22:24:13Z" Version="2.0"><saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://{HOST}/Shibboleth.sso</saml:Issuer><samlp:Extensions><aslo:Asynchronous xmlns:aslo="urn:oasis:names:tc:SAML:2.0:protocol:ext:async-slo"/></samlp:Extensions><saml:EncryptedID xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"><xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" Type="http://www.w3.org/2001/04/xmlenc#Element">
<xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc"/>
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><xenc:EncryptedKey xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
<xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p">
<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
</xenc:EncryptionMethod>
<xenc:CipherData>
<xenc:CipherValue>SiKCNbwKk+cccaVAuG/bRvWpb9Vig/i4OPg2/u1wNXp8JH7PZ2G+z+HLI0YGsn/5v5LlEhMsMUIl
D/Vi4PNFrvTeNFWFAZK1nWsMhB9RGKH4g3s195CqTASxi35wuTymM5E9L74/r8rmsoiu+KgsGO3y
BT5tpVIC6KAM02lKJSr0VS5rpqOzPEomynunCAxzeizF/QW/G85Uti39iVvEycdrvGx71KY/kjVJ
zdetI26HwkzsVpbrE4BH8eHjw464UPj8DiLARqaW1lGtNCiHVrDcUAzZplY89Rqwn4BCLvKWT9HM
0xup5Z4GLmNNCdswur/04IQbjIUrq221MVghqA==</xenc:CipherValue>
</xenc:CipherData>
</xenc:EncryptedKey></ds:KeyInfo>
<xenc:CipherData>
<xenc:CipherValue>4IdvmNHEVwlwyRjKg09JowCqR0V7LjJMHC+fCJAmpEmodNOqzCF9plFGAybGL5/Pu0L6d7nKizn3
…
…
dH/LJ3A/DBsdQhKr75mIMTQqh3HpGjtwIzXQpPNE+6ew</xenc:CipherValue>
</xenc:CipherData></xenc:EncryptedData></saml:EncryptedID><samlp:SessionIndex>_a9b082655e3a86c8677066507c6e91e3</samlp:SessionIndex></samlp:LogoutRequest>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170830/dbc243af/attachment-0001.html>