Error cloning AttributeValue - Unable to root namespaces of cached DOM element
Paul B. Henson
henson at cpp.edu
Tue Sep 15 03:21:48 UTC 2020
So I'm working on setting up EntityAttributes MetadataFilters on my CAS
metadata and hitting an odd error.
With this config:
<MetadataProvider id="cpp-cas"
xsi:type="FilesystemMetadataProvider"
metadataFile="%{idp.home}/metadata/cpp-cas.xml"
indexesRef="shibboleth.CASMetadataIndices"
minRefreshDelay="PT1H" maxRefreshDelay="PT24H">
<MetadataFilter xsi:type="SchemaValidation" />
<MetadataFilter xsi:type="EntityAttributes">
<saml:Attribute Name="http://shibboleth.net/ns/attributes/releaseAllValues"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml:AttributeValue>id_group</saml:AttributeValue>
</saml:Attribute>
<Entity>https://apps.cpp.edu/banner_report</Entity>
</MetadataFilter>
<MetadataFilter xsi:type="EntityAttributes">
<saml:Attribute Name="http://shibboleth.net/ns/attributes/releaseAllValues"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml:AttributeValue>memberOf</saml:AttributeValue>
</saml:Attribute>
<Entity>https://apps.cpp.edu/banner_report</Entity>
<Entity>https://mailman.cpp.edu/mailman/</Entity>
<Entity>https://monitor.csupomona.net/</Entity>
<Entity>https://monitor.unx.cpp.edu/</Entity>
<Entity>https://src.it.cpp.edu/</Entity>
<Entity>https://torrus.csupomona.net/</Entity>
<Entity>https://www.cpp.edu/</Entity>
<Entity>https://www.idm.unx.cpp.edu/</Entity>
<Entity>https://www.unx.cpp.edu/</Entity>
</MetadataFilter>
</MetadataProvider>
I get this failure:
2020-09-14 20:08:19,092 - / - ERROR [org.opensaml.core.xml.io.AbstractXMLObjectMarshaller:454] - Unable to root namespaces of cached DOM element, {urn:oasis:names:tc:SAML:2.0:assertion}AttributeValue: Unable to resolve namespace prefix saml found on element {urn:oasis:names:tc:SAML:2.0:assertion}AttributeValue
2020-09-14 20:08:19,093 - / - ERROR [org.opensaml.saml.metadata.resolver.filter.impl.EntityAttributesFilter:233] - Error cloning AttributeValue org.opensaml.core.xml.io.MarshallingException: Unable to root namespaces of cached DOM element, {urn:oasis:names:tc:SAML:2.0:assertion}AttributeValue
[...]
Caused by: org.w3c.dom.DOMException: Unable to resolve namespace prefix saml found on element {urn:oasis:names:tc:SAML:2.0:assertion}AttributeValue
If I remove "https://apps.cpp.edu/banner_report" from the first filter,
it works fine. If I remove it from the second filter, it works fine.
But listed on both? BOOM.
I tried enabling debugging and nothing jumped out:
2020-09-14 20:13:49,315 - / - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:362] - M
etadata Resolver FilesystemMetadataResolver cpp-cas: Beginning refresh of metadata from '/opt/shibboleth-idp/metadata/cp
p-cas.xml'
2020-09-14 20:13:49,316 - / - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:369] - M
etadata Resolver FilesystemMetadataResolver cpp-cas: Processing new metadata from '/opt/shibboleth-idp/metadata/cpp-cas.
xml'
2020-09-14 20:13:49,316 - / - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:499] - M
etadata Resolver FilesystemMetadataResolver cpp-cas: Unmarshalling metadata from '/opt/shibboleth-idp/metadata/cpp-cas.x
ml'
2020-09-14 20:13:49,333 - / - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:546] - M
etadata Resolver FilesystemMetadataResolver cpp-cas: Preprocessing metadata from '/opt/shibboleth-idp/metadata/cpp-cas.x
ml'
2020-09-14 20:13:49,333 - / - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractMetadataResolver:377] - Metadata R
esolver FilesystemMetadataResolver cpp-cas: Applying metadata filter
2020-09-14 20:13:49,334 - / - DEBUG [org.opensaml.saml.metadata.resolver.filter.MetadataFilterChain:72] - Applying filte
r org.opensaml.saml.metadata.resolver.filter.impl.SchemaValidationFilter
2020-09-14 20:13:49,543 - / - DEBUG [org.opensaml.saml.metadata.resolver.filter.MetadataFilterChain:72] - Applying filte
r org.opensaml.saml.metadata.resolver.filter.impl.EntityAttributesFilter
2020-09-14 20:13:49,547 - / - INFO [org.opensaml.saml.metadata.resolver.filter.impl.EntityAttributesFilter:238] - Adding new EntityAttribute (http://shibboleth.net/ns/attributes/releaseAllValues) to EntityDescriptor (https://apps.cpp.edu/banner_report)
2020-09-14 20:13:49,549 - / - DEBUG [org.opensaml.saml.metadata.resolver.filter.MetadataFilterChain:72] - Applying filte
r org.opensaml.saml.metadata.resolver.filter.impl.EntityAttributesFilter
2020-09-14 20:13:49,549 - / - INFO [org.opensaml.saml.metadata.resolver.filter.impl.EntityAttributesFilter:238] - Adding
new EntityAttribute (http://shibboleth.net/ns/attributes/releaseAllValues) to EntityDescriptor (https://www.idm.unx.cpp
.edu/)
2020-09-14 20:13:49,550 - / - INFO [org.opensaml.saml.metadata.resolver.filter.impl.EntityAttributesFilter:238] - Adding
new EntityAttribute (http://shibboleth.net/ns/attributes/releaseAllValues) to EntityDescriptor (https://mailman.cpp.edu
/mailman/)
2020-09-14 20:13:49,550 - / - INFO [org.opensaml.saml.metadata.resolver.filter.impl.EntityAttributesFilter:238] - Adding
new EntityAttribute (http://shibboleth.net/ns/attributes/releaseAllValues) to EntityDescriptor (https://monitor.unx.cpp
.edu/)
2020-09-14 20:13:49,550 - / - INFO [org.opensaml.saml.metadata.resolver.filter.impl.EntityAttributesFilter:238] - Adding
new EntityAttribute (http://shibboleth.net/ns/attributes/releaseAllValues) to EntityDescriptor (https://torrus.csupomon
a.net/)
2020-09-14 20:13:49,551 - / - INFO [org.opensaml.saml.metadata.resolver.filter.impl.EntityAttributesFilter:229] - Adding
value to existing EntityAttribute (http://shibboleth.net/ns/attributes/releaseAllValues) on EntityDescriptor (https://a
pps.cpp.edu/banner_report)
2020-09-14 20:13:49,552 - / - ERROR [org.opensaml.core.xml.io.AbstractXMLObjectMarshaller:454] - Unable to root namespaces of cached DOM element, {urn:oasis:names:tc:SAML:2.0:assertion}AttributeValue: Unable to resolve namespace prefix saml found on element {urn:oasis:names:tc:SAML:2.0:assertion}AttributeValue
2020-09-14 20:13:49,553 - / - ERROR [org.opensaml.saml.metadata.resolver.filter.impl.EntityAttributesFilter:233] - Error cloning AttributeValue
org.opensaml.core.xml.io.MarshallingException: Unable to root namespaces of cached DOM element, {urn:oasis:names:tc:SAML:2.0:assertion}AttributeValue
at org.opensaml.core.xml.io.AbstractXMLObjectMarshaller.prepareForAdoption(AbstractXMLObjectMarshaller.java:455)
Caused by: org.w3c.dom.DOMException: Unable to resolve namespace prefix saml found on element {urn:oasis:names:tc:SAML:2.0:assertion}AttributeValue
at net.shibboleth.utilities.java.support.xml.NamespaceSupport.rootNamespaces(NamespaceSupport.java:253)
I thought maybe it was a generic issue with an entity-id in multiple filters,
but this works fine:
<MetadataFilter xsi:type="EntityAttributes">
<saml:Attribute Name="http://shibboleth.net/ns/attributes/releaseAllValues"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml:AttributeValue>id_group</saml:AttributeValue>
</saml:Attribute>
<Entity>https://mailman.cpp.edu/mailman/</Entity>
</MetadataFilter>
<MetadataFilter xsi:type="EntityAttributes">
<saml:Attribute Name="http://shibboleth.net/ns/attributes/releaseAllValues"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml:AttributeValue>memberOf</saml:AttributeValue>
</saml:Attribute>
<Entity>https://apps.cpp.edu/banner_report</Entity>
<Entity>https://monitor.csupomona.net/</Entity>
<Entity>https://monitor.unx.cpp.edu/</Entity>
<Entity>https://src.it.cpp.edu/</Entity>
<Entity>https://torrus.csupomona.net/</Entity>
<Entity>https://www.cpp.edu/</Entity>
<Entity>https://www.idm.unx.cpp.edu/</Entity>
<Entity>https://www.unx.cpp.edu/</Entity>
</MetadataFilter>
I don't think there's anything wrong with the metadata:
<EntityDescriptor entityID="https://apps.cpp.edu/banner_report">
<SPSSODescriptor protocolSupportEnumeration="https://www.apereo.org/cas/protocol">
<AssertionConsumerService Binding="https://www.apereo.org/cas/protocol/login"
Location="https://apps.cpp.edu/banner_report"
index="1"/>
<AssertionConsumerService Binding="https://www.apereo.org/cas/protocol/login"
Location="https://apps-tst.cpp.edu/banner_report"
index="2"/>
<AssertionConsumerService Binding="https://www.apereo.org/cas/protocol/login"
Location="https://apps-dev.cpp.edu/banner_report"
index="3"/>
</SPSSODescriptor>
</EntityDescriptor>
compared to:
<EntityDescriptor entityID="https://mailman.cpp.edu/mailman/">
<SPSSODescriptor protocolSupportEnumeration="https://www.apereo.org/cas/protocol">
<AssertionConsumerService Binding="https://www.apereo.org/cas/protocol/login"
Location="https://mailman.cpp.edu/mailman/"
index="1"/>
<AssertionConsumerService Binding="https://www.apereo.org/cas/protocol/login"
Location="https://mailman.cpp.edu/cgi-bin/"
index="2"/>
</SPSSODescriptor>
</EntityDescriptor>
Any thoughts on this odd failure?
--
Paul B. Henson | (909) 979-6361 | http://www.cpp.edu/~henson/
Operating Systems and Network Analyst | henson at cpp.edu
California State Polytechnic University | Pomona CA 91768
More information about the users
mailing list