shibd should return 4xx rather than 500 on wrong URL parameter

[井戸 文則]

Hello all,

I'm asking question here because SP3 top page(*1) > Bug 
Reports/Enhancement Requests(*2) looks not working today (it says 
"Something's gone wrong").

== Situation

When a end-user accesses our app(which runs with Shibboleth SSO) with 
some obsoleted SAML info like the following URL:

   https://[APP-HOST]/Shibboleth.sso/SLO/SOAP?SAMLRequest=DUMMY

then, Nginx (with backend shibd) returns 500 to the user and logs as 
follows:

<<<<<log begin<<<<<
2023/10/20 07:54:53 [error] 20#0: *3065 FastCGI sent in stderr: "shib:" 
while reading response header from upstream, client: ##.##.##.##, 
server: [APP-HOST], request: "GET 
/Shibboleth.sso/SLO/SOAP?SAMLRequest=DUMMY HTTP/1.1", upstream: 
"fastcgi://unix:/var/run/shibboleth/shibresponder.sock:", host: "[APP-HOST]"
2023/10/20 07:54:53 [error] 20#0: *3065 FastCGI sent in stderr: 
"Shibboleth handler invoked at an unconfigured location" while reading 
response header from upstream, client: ##.##.##.##, server: [APP-HOST], 
request: "GET /Shibboleth.sso/SLO/SOAP?SAMLRequest=DUMMY HTTP/1.1", 
upstream: "fastcgi://unix:/var/run/shibboleth/shibresponder.sock:", 
host: "[APP-HOST]"
##.##.##.## - - [20/Oct/2023:07:54:53 +0900] "GET 
/Shibboleth.sso/SLO/SOAP?SAMLRequest=test-by-ido HTTP/1.1" 500 952 "-" 
"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) 
Chrome/118.0.0.0 Safari/537.36" "-"
 >>>>>log end>>>>>

and users browser page is as follows:

<<<<<browser page begin<<<<<
shibsp::ConfigurationException
The system encountered an error at Fri Oct 20 13:17:26 2023
To report this problem, please contact the site administrator at ...
Please include the following message in any email:
shibsp::ConfigurationException at 
(https://[APP-HOST]/Shibboleth.sso/SLO/SOAP)
Shibboleth handler invoked at an unconfigured location.
 >>>>>browser page end>>>>>

I think this is user side fault so that shibd should return 4xx 
(probably 422) rather than 5xx (shibd and IdP side SAML setting), right?

Why this 4xx vs 5xx is an issue for us is that our monitoring system 
watches 5xx and alert us 24h x 365days.  Sometimes this kind of 500 
error with wrong SAML parameter happens.

If SAML configuration itself at shibd & IdP (typically under /etc/ 
directory) is wrong, then 5xx is acceptable for me.  However, wrong URL 
parameter triggered by user should be 4xx, I think.


== My Environment

OS::			CentOS 7.9.2009
shibd version::		3.4.0


---
(*1) 
https://shibboleth.atlassian.net/wiki/spaces/SP3/overview?homepageId=2058387896
(*2) https://shibboleth.atlassian.net/jira/projects