Strict XML processing + unexpected content in ACS URL

[Brent Putman]

On 3/4/25 4:35 PM, Janemarie Duh via users wrote:

> To refresh memories, the strict default was new with IdPv5:
>
>     The XML processing code in OpenSAML has been enhanced to support
>     a more strict form of processing that rejects unexpected/unknown
>     XML Attributes, Elements, and even stray characters inside
>     elements. Older versions tended to ignore them. In the vast
>     majority of cases, rejecting such content is desirable but it is
>     possible to turn off this processing mode by setting the property
>     *opensaml.config.xml.unmarshall.strictMode* to “false”. Note that
>     this setting appears to reject otherwise valid metadata produced
>     by Microsoft products (see Known Bugs).
>

Your issue doesn't have anything to do with this new setting. That's 
about "unknown" XML attributes, elements and element content which 
isn't specified in the relevant XML schemas. That's at a much higher 
level of XML processing than your error...


>
> Their ACS url looks like this:
>
>     https://uofdepd.evidence.com/?class=UIX&proc=Login
>     <https://uofdepd.evidence.com/?class=UIX&proc=Login>
>
>
> Upon restarting Jetty, errors appear because the xml parser sees 
> "proc" as unexpected content and thinks a semicolon delimiter is 
> required after it.


Your error is that literal '&' characters aren't allowed in XML, 
period.  The '&' is a special reserved character used to represent an 
'entity', which is sort of like a macro that is replaced at parse 
time.  An entity always terminates with a ';', and it's not seeing a 
terminating ';',.  So that's literally what it is complaining about. 
It's fundamentally invalid XML. This is a very low-level XML parsing 
error, nothing to do with Shibboleth software choices, etc.

For the correct way, see the wiki, which happens to have the correct 
example for your exact ACS issue:

https://shibboleth.atlassian.net/wiki/spaces/CONCEPT/pages/928645443/MetadataCorrectness#MetadataCorrectness-EncodingofSpecialCharacters

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250304/b9e559fd/attachment.htm>