Ex: Error cloning AttributeValue - Unable to root namespaces of cached DOM element
Paul B. Henson
henson at cpp.edu
Tue Sep 15 03:28:55 UTC 2020
Well, hello there, OSJ-321 -
https://issues.shibboleth.net/jira/browse/OSJ-321
It looks like it isn't fixed yet. I'm not clear whether any of the
possible workarounds mentioned in the bug are suitable for production?
It's strange that it only triggers for some cases of adding new values
but not all?
On Mon, Sep 14, 2020 at 08:21:48PM -0700, Paul B. Henson wrote:
> So I'm working on setting up EntityAttributes MetadataFilters on my CAS
> metadata and hitting an odd error.
>
> With this config:
>
> <MetadataProvider id="cpp-cas"
> xsi:type="FilesystemMetadataProvider"
> metadataFile="%{idp.home}/metadata/cpp-cas.xml"
> indexesRef="shibboleth.CASMetadataIndices"
> minRefreshDelay="PT1H" maxRefreshDelay="PT24H">
>
> <MetadataFilter xsi:type="SchemaValidation" />
>
> <MetadataFilter xsi:type="EntityAttributes">
> <saml:Attribute Name="http://shibboleth.net/ns/attributes/releaseAllValues"
> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
> <saml:AttributeValue>id_group</saml:AttributeValue>
> </saml:Attribute>
> <Entity>https://apps.cpp.edu/banner_report</Entity>
> </MetadataFilter>
>
> <MetadataFilter xsi:type="EntityAttributes">
> <saml:Attribute Name="http://shibboleth.net/ns/attributes/releaseAllValues"
> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
> <saml:AttributeValue>memberOf</saml:AttributeValue>
> </saml:Attribute>
> <Entity>https://apps.cpp.edu/banner_report</Entity>
> <Entity>https://mailman.cpp.edu/mailman/</Entity>
> <Entity>https://monitor.csupomona.net/</Entity>
> <Entity>https://monitor.unx.cpp.edu/</Entity>
> <Entity>https://src.it.cpp.edu/</Entity>
> <Entity>https://torrus.csupomona.net/</Entity>
> <Entity>https://www.cpp.edu/</Entity>
> <Entity>https://www.idm.unx.cpp.edu/</Entity>
> <Entity>https://www.unx.cpp.edu/</Entity>
> </MetadataFilter>
>
> </MetadataProvider>
>
> I get this failure:
>
> 2020-09-14 20:08:19,092 - / - ERROR [org.opensaml.core.xml.io.AbstractXMLObjectMarshaller:454] - Unable to root namespaces of cached DOM element, {urn:oasis:names:tc:SAML:2.0:assertion}AttributeValue: Unable to resolve namespace prefix saml found on element {urn:oasis:names:tc:SAML:2.0:assertion}AttributeValue
> 2020-09-14 20:08:19,093 - / - ERROR [org.opensaml.saml.metadata.resolver.filter.impl.EntityAttributesFilter:233] - Error cloning AttributeValue org.opensaml.core.xml.io.MarshallingException: Unable to root namespaces of cached DOM element, {urn:oasis:names:tc:SAML:2.0:assertion}AttributeValue
> [...]
> Caused by: org.w3c.dom.DOMException: Unable to resolve namespace prefix saml found on element {urn:oasis:names:tc:SAML:2.0:assertion}AttributeValue
>
> If I remove "https://apps.cpp.edu/banner_report" from the first filter,
> it works fine. If I remove it from the second filter, it works fine.
> But listed on both? BOOM.
>
> I tried enabling debugging and nothing jumped out:
>
> 2020-09-14 20:13:49,315 - / - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:362] - M
> etadata Resolver FilesystemMetadataResolver cpp-cas: Beginning refresh of metadata from '/opt/shibboleth-idp/metadata/cp
> p-cas.xml'
> 2020-09-14 20:13:49,316 - / - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:369] - M
> etadata Resolver FilesystemMetadataResolver cpp-cas: Processing new metadata from '/opt/shibboleth-idp/metadata/cpp-cas.
> xml'
> 2020-09-14 20:13:49,316 - / - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:499] - M
> etadata Resolver FilesystemMetadataResolver cpp-cas: Unmarshalling metadata from '/opt/shibboleth-idp/metadata/cpp-cas.x
> ml'
> 2020-09-14 20:13:49,333 - / - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:546] - M
> etadata Resolver FilesystemMetadataResolver cpp-cas: Preprocessing metadata from '/opt/shibboleth-idp/metadata/cpp-cas.x
> ml'
> 2020-09-14 20:13:49,333 - / - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractMetadataResolver:377] - Metadata R
> esolver FilesystemMetadataResolver cpp-cas: Applying metadata filter
> 2020-09-14 20:13:49,334 - / - DEBUG [org.opensaml.saml.metadata.resolver.filter.MetadataFilterChain:72] - Applying filte
> r org.opensaml.saml.metadata.resolver.filter.impl.SchemaValidationFilter
> 2020-09-14 20:13:49,543 - / - DEBUG [org.opensaml.saml.metadata.resolver.filter.MetadataFilterChain:72] - Applying filte
> r org.opensaml.saml.metadata.resolver.filter.impl.EntityAttributesFilter
> 2020-09-14 20:13:49,547 - / - INFO [org.opensaml.saml.metadata.resolver.filter.impl.EntityAttributesFilter:238] - Adding new EntityAttribute (http://shibboleth.net/ns/attributes/releaseAllValues) to EntityDescriptor (https://apps.cpp.edu/banner_report)
> 2020-09-14 20:13:49,549 - / - DEBUG [org.opensaml.saml.metadata.resolver.filter.MetadataFilterChain:72] - Applying filte
> r org.opensaml.saml.metadata.resolver.filter.impl.EntityAttributesFilter
> 2020-09-14 20:13:49,549 - / - INFO [org.opensaml.saml.metadata.resolver.filter.impl.EntityAttributesFilter:238] - Adding
> new EntityAttribute (http://shibboleth.net/ns/attributes/releaseAllValues) to EntityDescriptor (https://www.idm.unx.cpp
> .edu/)
> 2020-09-14 20:13:49,550 - / - INFO [org.opensaml.saml.metadata.resolver.filter.impl.EntityAttributesFilter:238] - Adding
> new EntityAttribute (http://shibboleth.net/ns/attributes/releaseAllValues) to EntityDescriptor (https://mailman.cpp.edu
> /mailman/)
> 2020-09-14 20:13:49,550 - / - INFO [org.opensaml.saml.metadata.resolver.filter.impl.EntityAttributesFilter:238] - Adding
> new EntityAttribute (http://shibboleth.net/ns/attributes/releaseAllValues) to EntityDescriptor (https://monitor.unx.cpp
> .edu/)
> 2020-09-14 20:13:49,550 - / - INFO [org.opensaml.saml.metadata.resolver.filter.impl.EntityAttributesFilter:238] - Adding
> new EntityAttribute (http://shibboleth.net/ns/attributes/releaseAllValues) to EntityDescriptor (https://torrus.csupomon
> a.net/)
> 2020-09-14 20:13:49,551 - / - INFO [org.opensaml.saml.metadata.resolver.filter.impl.EntityAttributesFilter:229] - Adding
> value to existing EntityAttribute (http://shibboleth.net/ns/attributes/releaseAllValues) on EntityDescriptor (https://a
> pps.cpp.edu/banner_report)
> 2020-09-14 20:13:49,552 - / - ERROR [org.opensaml.core.xml.io.AbstractXMLObjectMarshaller:454] - Unable to root namespaces of cached DOM element, {urn:oasis:names:tc:SAML:2.0:assertion}AttributeValue: Unable to resolve namespace prefix saml found on element {urn:oasis:names:tc:SAML:2.0:assertion}AttributeValue
> 2020-09-14 20:13:49,553 - / - ERROR [org.opensaml.saml.metadata.resolver.filter.impl.EntityAttributesFilter:233] - Error cloning AttributeValue
> org.opensaml.core.xml.io.MarshallingException: Unable to root namespaces of cached DOM element, {urn:oasis:names:tc:SAML:2.0:assertion}AttributeValue
> at org.opensaml.core.xml.io.AbstractXMLObjectMarshaller.prepareForAdoption(AbstractXMLObjectMarshaller.java:455)
> Caused by: org.w3c.dom.DOMException: Unable to resolve namespace prefix saml found on element {urn:oasis:names:tc:SAML:2.0:assertion}AttributeValue
> at net.shibboleth.utilities.java.support.xml.NamespaceSupport.rootNamespaces(NamespaceSupport.java:253)
>
> I thought maybe it was a generic issue with an entity-id in multiple filters,
> but this works fine:
>
> <MetadataFilter xsi:type="EntityAttributes">
> <saml:Attribute Name="http://shibboleth.net/ns/attributes/releaseAllValues"
> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
> <saml:AttributeValue>id_group</saml:AttributeValue>
> </saml:Attribute>
> <Entity>https://mailman.cpp.edu/mailman/</Entity>
> </MetadataFilter>
>
> <MetadataFilter xsi:type="EntityAttributes">
> <saml:Attribute Name="http://shibboleth.net/ns/attributes/releaseAllValues"
> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
> <saml:AttributeValue>memberOf</saml:AttributeValue>
> </saml:Attribute>
> <Entity>https://apps.cpp.edu/banner_report</Entity>
> <Entity>https://monitor.csupomona.net/</Entity>
> <Entity>https://monitor.unx.cpp.edu/</Entity>
> <Entity>https://src.it.cpp.edu/</Entity>
> <Entity>https://torrus.csupomona.net/</Entity>
> <Entity>https://www.cpp.edu/</Entity>
> <Entity>https://www.idm.unx.cpp.edu/</Entity>
> <Entity>https://www.unx.cpp.edu/</Entity>
> </MetadataFilter>
>
> I don't think there's anything wrong with the metadata:
>
> <EntityDescriptor entityID="https://apps.cpp.edu/banner_report">
> <SPSSODescriptor protocolSupportEnumeration="https://www.apereo.org/cas/protocol">
> <AssertionConsumerService Binding="https://www.apereo.org/cas/protocol/login"
> Location="https://apps.cpp.edu/banner_report"
> index="1"/>
> <AssertionConsumerService Binding="https://www.apereo.org/cas/protocol/login"
> Location="https://apps-tst.cpp.edu/banner_report"
> index="2"/>
> <AssertionConsumerService Binding="https://www.apereo.org/cas/protocol/login"
> Location="https://apps-dev.cpp.edu/banner_report"
> index="3"/>
> </SPSSODescriptor>
> </EntityDescriptor>
>
> compared to:
>
> <EntityDescriptor entityID="https://mailman.cpp.edu/mailman/">
> <SPSSODescriptor protocolSupportEnumeration="https://www.apereo.org/cas/protocol">
> <AssertionConsumerService Binding="https://www.apereo.org/cas/protocol/login"
> Location="https://mailman.cpp.edu/mailman/"
> index="1"/>
> <AssertionConsumerService Binding="https://www.apereo.org/cas/protocol/login"
> Location="https://mailman.cpp.edu/cgi-bin/"
> index="2"/>
> </SPSSODescriptor>
> </EntityDescriptor>
>
> Any thoughts on this odd failure?
>
>
> --
> Paul B. Henson | (909) 979-6361 | http://www.cpp.edu/~henson/
> Operating Systems and Network Analyst | henson at cpp.edu
> California State Polytechnic University | Pomona CA 91768
> --
> For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> CAUTION: This email was not sent from a Cal Poly Pomona service. Exercise caution when clicking links or opening attachments. Please forward suspicious email to suspectemail at cpp.edu<mailto:suspectemail at cpp.edu>.
>
--
Paul B. Henson | (909) 979-6361 | http://www.cpp.edu/~henson/
Operating Systems and Network Analyst | henson at cpp.edu
California State Polytechnic University | Pomona CA 91768
More information about the users
mailing list