Strict XML processing + unexpected content in ACS URL

[Janemarie Duh]

Good Afternoon,

We are running Shibboleth IdP v5.1.2 with Jetty 12.0.14 and Amazon Corretto
17.0.14.7.1 and the default of Strict for entity resolution. To refresh
memories, the strict default was new with IdPv5:

The XML processing code in OpenSAML has been enhanced to support a more
> strict form of processing that rejects unexpected/unknown XML Attributes,
> Elements, and even stray characters inside elements. Older versions tended
> to ignore them. In the vast majority of cases, rejecting such content is
> desirable but it is possible to turn off this processing mode by setting
> the property *opensaml.config.xml.unmarshall.strictMode* to “false”. Note
> that this setting appears to reject otherwise valid metadata produced by
> Microsoft products (see Known Bugs).
>

The problem: I have an SP that does SAML but doesn't play with Shib nicely.
Their ACS url looks like this:

 https://uofdepd.evidence.com/?class=UIX&proc=Login


Upon restarting Jetty, errors appear because the xml parser sees "proc" as
unexpected content and thinks a semicolon delimiter is required after it. I
confirmed this by validating the xml and editing my cobbled together
metadata until it validated. A relevant portion of the log is below my sig.

Has anyone run into this? Is there a way to get around it besides changing
strict to false?

            Janemarie


Caused by: net.shibboleth.shared.resolver.ResolverException: Exception
> during refresh
> at
> org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver.refresh(AbstractReloadingMetadataResolver.java:398)
> Caused by: net.shibboleth.shared.resolver.ResolverException: Unable to
> unmarshall metadata
> at
> org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver.unmarshallMetadata(AbstractReloadingMetadataResolver.java:494)
> Caused by: org.opensaml.core.xml.io.UnmarshallingException:
> net.shibboleth.shared.xml.XMLParserException: Unable to parse inputstream,
> it contained invalid XML
> at
> org.opensaml.saml.metadata.resolver.impl.AbstractMetadataResolver.unmarshallMetadata(AbstractMetadataResolver.java:442)
> Caused by: net.shibboleth.shared.xml.XMLParserException: Unable to parse
> inputstream, it contained invalid XML
> at
> net.shibboleth.shared.xml.impl.BasicParserPool.parse(BasicParserPool.java:245)
> Caused by: org.xml.sax.SAXParseException: The reference to entity "proc"
> must end with the ';' delimiter.
> at
> java.xml/com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.createSAXParseException(ErrorHandlerWrapper.java:204)
> 2025-03-04 13:44:05,225 - ERROR
> [net.shibboleth.shared.service.AbstractReloadableService:183] - Service
> 'shibboleth.MetadataResolverService': No further attempts will be made to
> reload -



-- 

*Janemarie Duh*
UD Information Technologies
*Identity and Access Management Specialist*
duhj at udel.edu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250304/dd61a142/attachment.htm>