issue with workday and /idp/profile/SAML2/POST/SSO

Thu Jun 15 11:08:34 EDT 2017

Please ignore this message, we think it was caused by the following workday feature.

You should also check the Do Not Deflate... option. Sending a POST request while deflating is not SAML compliant (their system is apparently providing options to send non-compliant messages to accomodate broken IdPs).

Rhian Resnick

Assistant Director Middleware and HPC

Office of Information Technology

Florida Atlantic University

777 Glades Road, CM22, Rm 173B

Boca Raton, FL 33431

Phone 561.297.2647

Fax 561.297.0222

 [image] <https://hpc.fau.edu/wp-content/uploads/2015/01/image.jpg>

________________________________
From: Rhian Resnick
Sent: Thursday, June 15, 2017 10:22 AM
To: Shib Users
Cc: Carolina Schultz De Oliveira
Subject: issue with workday and /idp/profile/SAML2/POST/SSO

We are getting an interesting error form Shibboleth 3.3.1 when authenticating to Workday. Turns out we made a mistake in our configuration of the production IDP and Workday and were forwarding authentications to the redirect profile instead of the post profile (the redirect profile rejects the post requests in version 3.3.1)

I confirmed I can decode the saml request but for some reason we are getting the following error from the IDP stating it cannot decode the message.

Here is a request to POST and a sample of the error message.

Request URL:https://sso.fau.edu/idp/profile/SAML2/POST/SSO
Request Method:POST
Status Code:200 OK
Remote Address:131.91.101.225:443
Referrer Policy:no-referrer-when-downgrade
Response Headers
view source
Cache-Control:no-cache, no-store, must-revalidate, max-age=0
Connection:close
Content-Length:2479
Content-Type:text/html;charset=ISO-8859-1
Date:Thu, 15 Jun 2017 13:12:58 GMT
Expires:0
Pragma:no-cache
Request Headers
view source
Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding:gzip, deflate, br
Accept-Language:en-US,en;q=0.8
Cache-Control:max-age=0
Connection:keep-alive
Content-Length:430
Content-Type:application/x-www-form-urlencoded
Cookie:JSESSIONID=FA01B0D5DCAFA27C7D95C9F75C3CE05C; shib_idp_session=7e2466d44c74cbf429e836b6ab53c992a96f895899e3883811bd5c698562b8d0; _idp_session=NzYuMjYuNS45NA%3D%3D%7CLQ%3D%3D%7CMGM0NjVhMDY3MTIyZTUyYjAzMWJkNDQ3ZmFmZWVlZWUyZTdlMDlmZDJhZjI1MWExNWNhMDZhNzQ2OGQ1OWZiNg%3D%3D%7Czghr6IF9DYrIR8rQLQnD89TmH1g%3D; JSESSIONID=F225696A1585DA7202979002D8D53495; BIGipServerPROD_mwp1_shib_443_pool=1932530442.47873.0000; BIGipServerPROD_mwp1_cas_443_pool=1865421578.47873.0000; BIGipServerTEST_mwp1_shib_443_pool=1966084874.47873.0000; _ga=GA1.2.1239512240.1497057820; fos.web.server=mcportal2; fos.secure.web.server=mcportal2; runId=-4137272902464538516; JSESSIONID=DA21105A217125AEA52D8838F996302A; CASTGC=TGT-379342-P65Jb3iGTcmf4fFy9Bdaj3tc7C7isJ21TGLM3w4L5SfXua1Z1y-cas1.fau.edu
DNT:1
Host:sso.fau.edu
Origin:https://impl.workday.com
Referer:https://impl.workday.com/wday/authgwy/fau/login-saml2.htmld
Upgrade-Insecure-Requests:1
User-Agent:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.86 Safari/537.36
Form Data
view source
view URL encoded
SAMLRequest:fZFBT4NAEIXv/gqy94UFSlsmhabGNDbRSCx68GKWZbFE2K07S6n/XqQa66XHmcy8976ZxfLYNs5B
Gqy1SojvMuJIJXRZq7eEPOVrOifL9GqBvG32sOrsTj3Kj06iddbaCDl2ElLxBiVxNjcJeZ3xkFVx
UdCwjAWdTOclLcqCUSbiSSSkqKo4HkYx44j1Qf4tI3Zyo9ByZRMSMH9G2ZT6Ue6H4AcQzV3G2Atx
MqOtFrq5rtUpZWcUaI41guKtRLACtqv7OwhcBsVpCOE2zzOaPWxz4jz/0gbftAO/Qhj5Lkvtf3xJ
Ol4jgDGwORMILgsMvNLYwZmkO2v34Hl937u9Nu8l/3SFbr2Kd8hVWejjwjv3SE/l/wekXw==

idp-process.log

2017-06-15 09:46:51,448 - WARN [org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event occurred while processing the request: UnableToDecode
2017-06-15 09:46:51,448 - DEBUG [org.opensaml.saml.common.profile.logic.DefaultLocalErrorPredicate:154] - No SAMLBindingContext or binding URI available, error must be handled locally
2017-06-15 09:46:55,040 - DEBUG [org.opensaml.saml.saml2.binding.decoding.impl.HTTPPostDecoder:86] - Decoded SAML relay state of: null
2017-06-15 09:46:55,040 - DEBUG [org.opensaml.saml.saml2.binding.decoding.impl.HTTPPostDecoder:109] - Getting Base64 encoded message from request
2017-06-15 09:46:55,042 - ERROR [org.opensaml.messaging.decoder.servlet.BaseHttpServletRequestXMLMessageDecoder:157] - Error unmarshalling message from input stream
net.shibboleth.utilities.java.support.xml.XMLParserException: Unable to read data from input stream
at net.shibboleth.utilities.java.support.xml.BasicParserPool.parse(BasicParserPool.java:251)
Caused by: com.sun.org.apache.xerces.internal.impl.io.MalformedByteSequenceException: Invalid byte 1 of 1-byte UTF-8 sequence.
at com.sun.org.apache.xerces.internal.impl.io.UTF8Reader.invalidByte(UTF8Reader.java:701)
2017-06-15 09:46:55,044 - ERROR [org.opensaml.profile.action.impl.DecodeMessage:73] - Profile Action DecodeMessage: Unable to decode incoming request
org.opensaml.messaging.decoder.MessageDecodingException: Error unmarshalling message from input stream
at org.opensaml.messaging.decoder.servlet.BaseHttpServletRequestXMLMessageDecoder.unmarshallMessage(BaseHttpServletRequestXMLMessageDecoder.java:158)
Caused by: net.shibboleth.utilities.java.support.xml.XMLParserException: Unable to read data from input stream
at net.shibboleth.utilities.java.support.xml.BasicParserPool.parse(BasicParserPool.java:251)
Caused by: com.sun.org.apache.xerces.internal.impl.io.MalformedByteSequenceException: Invalid byte 1 of 1-byte UTF-8 sequence.
at com.sun.org.apache.xerces.internal.impl.io.UTF8Reader.invalidByte(UTF8Reader.java:701)
2017-06-15 09:46:55,044 - WARN [org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event occurred while processing the request: UnableToDecode
2017-06-15 09:46:55,045 - DEBUG [org.opensaml.saml.common.profile.logic.DefaultLocalErrorPredicate:154] - No SAMLBindingContext or binding URI available, error must be handled locally

Here is a post to the Redirect profile.

Request URL:https://sso.fau.edu/idp/profile/SAML2/Redirect/SSO
Request Method:POST
Status Code:302 Found
Remote Address:131.91.101.225:443
Referrer Policy:no-referrer-when-downgrade
Response Headers
view source
Cache-Control:no-cache, no-store, must-revalidate, max-age=0
Connection:close
Content-Length:0
Content-Type:text/plain; charset=UTF-8
Date:Thu, 15 Jun 2017 13:28:58 GMT
Expires:0
Location:https://sso.fau.edu:443/idp/AuthnEngine
Pragma:no-cache
Set-Cookie:_idp_authn_lc_key=df4a00a4ce21e25a1aca39e11742a8eb15a3eb9641ee76cf9eaa1abf388e7fb3; Version=1; Path=/idp; Secure
Request Headers
view source
Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding:gzip, deflate, br
Accept-Language:en-US,en;q=0.8
Cache-Control:max-age=0
Connection:keep-alive
Content-Length:438
Content-Type:application/x-www-form-urlencoded
Cookie:JSESSIONID=FA01B0D5DCAFA27C7D95C9F75C3CE05C; shib_idp_session=7e2466d44c74cbf429e836b6ab53c992a96f895899e3883811bd5c698562b8d0; JSESSIONID=F225696A1585DA7202979002D8D53495; _idp_session=NzMuODUuMjA1Ljk1%7CLQ%3D%3D%7CYzY1ZTY0YmM4YzdmY2RkYjkxOGQ3YTI2OTI3ZDI0YTVjM2NmNTNhNThlNDM1N2ZiMGU4MzFiNDY0ZmVkZTAzZQ%3D%3D%7CsK%2BQmlF1y1Wpf2OXy3O2pxzsqKk%3D; BIGipServerPROD_mwp1_shib_443_pool=1932530442.47873.0000; BIGipServerPROD_mwp1_cas_443_pool=1865421578.47873.0000; BIGipServerTEST_mwp1_shib_443_pool=1966084874.47873.0000; _ga=GA1.2.1239512240.1497057820; fos.web.server=mcportal2; fos.secure.web.server=mcportal2; runId=-4137272902464538516; JSESSIONID=2EB99FA2AB9F37BD2EBDCA87BE2F9F19; CASTGC=TGT-381344-grQieUFcydcXwgzoo5m0AoiiJb3pG1HsFLaw4rYKMzcdUSsvVQ-cas1.fau.edu
DNT:1
Host:sso.fau.edu
Origin:https://impl.workday.com
Referer:https://impl.workday.com/wday/authgwy/fau/login-saml2.htmld
Upgrade-Insecure-Requests:1
User-Agent:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.86 Safari/537.36
Form Data
view source
view URL encoded
SAMLRequest:fZHRT4MwEMbf/StI3wu0hQ2bwTJjFpdoJA598MV0pTgitLNXxvzvZUzjfNnjXe6+7/vdzeaHtvH2
ykJtdIqIHyJPaWnKWr+n6LlY4gTNs6sZiLbZ8UXntvpJfXYKnLc0Vqqxk6JKNKCQt7pN0VtZlkxV
aoJZRSSOIsqwIDLBIYuYjCMRT5PjKOQCoN6rv2WATq00OKFdimhIpjicYBIXhHGa8HjqXzPyirzc
GmekaW5qfUrZWc2NgBq4Fq0C7iRfLx7uOfVDvjkNAb8rihznj+sCeS+/tPRIO/Br4CPfZandjy/K
xmtQPga2ZwL0ssDAq6wbnFG2dW7Hg6Dve7839qMUX740bVCJDoQuN+YwC849slP5/wHZNw==

Rhian Resnick

Assistant Director Middleware and HPC

Office of Information Technology

Florida Atlantic University

777 Glades Road, CM22, Rm 173B

Boca Raton, FL 33431

Phone 561.297.2647

Fax 561.297.0222

 [image] <https://hpc.fau.edu/wp-content/uploads/2015/01/image.jpg>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170615/bfd74134/attachment-0001.html>