Error unmarshalling message from input stream

[Mohamed Lrhazi]

Thanks Steven. Do you know how do I
set opensaml.config.xml.unmarshall.strictMode to false? is that in
idp.properties ?

On Sun, Oct 27, 2024 at 2:53 PM Steven Premeau <steven.premeau at maine.edu>
wrote:

> Ultimately you should reach out to the service provider to correct their
> request, as it the AuthnContextClassRef should be in a
> RequestedAuthnContext element *(and you can search the list archives for
> comments about requesting an unspecified nameid format)*:
>
> <samlp:AuthnRequest ID="_8dabfa33-8361-4634-9377-63bc62a78ea2"
>                     Version="2.0"
>                     IssueInstant="2024-10-27T17:34:21Z"
>
> ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
>                     AssertionConsumerServiceURL="
> https://x34.emaint.com/wc.dll?X3~SAML"
>                     Destination="
> https://idp.cua.edu/idp/profile/SAML2/POST/SSO"
>                     ProviderName="emaint.com"
>                     xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
>                     >
>     <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
> https://x34.emaint.com/SAML</saml:Issuer>
>     <samlp:NameIDPolicy
> Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
>                         AllowCreate="true"
>                         />
> *    <samlp:RequestedAuthnContext>*
>
>         <saml:AuthnContextClassRef
>
>             xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">urn:
> oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
>
>         </saml:AuthnContextClassRef>
>
> *    </samlp:RequestedAuthnContext>*
>
> </samlp:AuthnRequest>
>
>
> That said, the key change between version 4 and version 5  likely causing
> your issue is documented in the release notes - search for
> <http://goog_189559321>opensaml.config.xml.unmarshall.strictMode
> <https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199500367/ReleaseNotes#:~:text=The%20XML%20processing,see%20Known%20Bugs).>
> .
>
> Steve.
>
> On Sun, Oct 27, 2024 at 1:58 PM Mohamed Lrhazi via users <
> users at shibboleth.net> wrote:
>
>> Hello,
>>
>> An SP that is working with our version 4 IdP appears to fail with version
>> 5. am getting the following error message:
>>
>> Error unmarshalling message from input stream: Saw invalid child element
>> {urn:oasis:names:tc:SAML:2.0:assertion}AuthnContextClassRef on parent
>> {urn:oasis:names:tc:SAML:2.0:protocol}AuthnRequest
>>
>> Is there a workaround to accept these requests in version 5 ?
>>
>> The requests look like this:
>>
>> <samlp:AuthnRequest ID="_8dabfa33-8361-4634-9377-63bc62a78ea2"
>> Version="2.0"
>> IssueInstant="2024-10-27T17:34:21Z"
>> ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
>> AssertionConsumerServiceURL="https://x34.emaint.com/wc.dll?X3~SAML"
>> Destination="https://idp.cua.edu/idp/profile/SAML2/POST/SSO"
>> ProviderName="emaint.com"
>> xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
>> >
>> <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
>> https://x34.emaint.com/SAML</saml:Issuer>
>> <samlp:NameIDPolicy Format=
>> "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
>> AllowCreate="true"
>> />
>> <saml:AuthnContextClassRef xmlns:saml=
>> "urn:oasis:names:tc:SAML:2.0:assertion"
>> >urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef>
>> </samlp:AuthnRequest>
>>
>> Thanks a lot,
>> Mohamed.
>> --
>> For Consortium Member technical support, see
>> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20241027/3c0d3607/attachment.htm>