Error unmarshalling message from input stream

[Steven Premeau]

Ultimately you should reach out to the service provider to correct their
request, as it the AuthnContextClassRef should be in a
RequestedAuthnContext element *(and you can search the list archives for
comments about requesting an unspecified nameid format)*:

<samlp:AuthnRequest ID="_8dabfa33-8361-4634-9377-63bc62a78ea2"
                    Version="2.0"
                    IssueInstant="2024-10-27T17:34:21Z"

ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
                    AssertionConsumerServiceURL="
https://x34.emaint.com/wc.dll?X3~SAML"
                    Destination="
https://idp.cua.edu/idp/profile/SAML2/POST/SSO"
                    ProviderName="emaint.com"
                    xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                    >
    <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
https://x34.emaint.com/SAML</saml:Issuer>
    <samlp:NameIDPolicy
Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
                        AllowCreate="true"
                        />
*    <samlp:RequestedAuthnContext>*

        <saml:AuthnContextClassRef

            xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">urn:
oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport

        </saml:AuthnContextClassRef>

*    </samlp:RequestedAuthnContext>*

</samlp:AuthnRequest>


That said, the key change between version 4 and version 5  likely causing
your issue is documented in the release notes - search for  <goog_189559321>
opensaml.config.xml.unmarshall.strictMode
<https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199500367/ReleaseNotes#:~:text=The%20XML%20processing,see%20Known%20Bugs).>
.

Steve.

On Sun, Oct 27, 2024 at 1:58 PM Mohamed Lrhazi via users <
users at shibboleth.net> wrote:

> Hello,
>
> An SP that is working with our version 4 IdP appears to fail with version
> 5. am getting the following error message:
>
> Error unmarshalling message from input stream: Saw invalid child element
> {urn:oasis:names:tc:SAML:2.0:assertion}AuthnContextClassRef on parent
> {urn:oasis:names:tc:SAML:2.0:protocol}AuthnRequest
>
> Is there a workaround to accept these requests in version 5 ?
>
> The requests look like this:
>
> <samlp:AuthnRequest ID="_8dabfa33-8361-4634-9377-63bc62a78ea2"
> Version="2.0"
> IssueInstant="2024-10-27T17:34:21Z"
> ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
> AssertionConsumerServiceURL="https://x34.emaint.com/wc.dll?X3~SAML"
> Destination="https://idp.cua.edu/idp/profile/SAML2/POST/SSO"
> ProviderName="emaint.com"
> xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
> >
> <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
> https://x34.emaint.com/SAML</saml:Issuer>
> <samlp:NameIDPolicy Format=
> "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
> AllowCreate="true"
> />
> <saml:AuthnContextClassRef xmlns:saml=
> "urn:oasis:names:tc:SAML:2.0:assertion"
> >urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef>
> </samlp:AuthnRequest>
>
> Thanks a lot,
> Mohamed.
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20241027/9da1deaf/attachment.htm>