Strict XML processing + unexpected content in ACS URL

[Janemarie Duh]

Thanks a bunch for the insight, Brent.

At the suggestion of another list member, I replaced the ampersand
with &

The IdP started without errors and now I can move on to testing.

       Janemarie

On Tue, Mar 4, 2025 at 5:08 PM Brent Putman via users <users at shibboleth.net>
wrote:

>
> On 3/4/25 4:35 PM, Janemarie Duh via users wrote:
>
> To refresh memories, the strict default was new with IdPv5:
>
> The XML processing code in OpenSAML has been enhanced to support a more
>> strict form of processing that rejects unexpected/unknown XML Attributes,
>> Elements, and even stray characters inside elements. Older versions tended
>> to ignore them. In the vast majority of cases, rejecting such content is
>> desirable but it is possible to turn off this processing mode by setting
>> the property *opensaml.config.xml.unmarshall.strictMode* to “false”.
>> Note that this setting appears to reject otherwise valid metadata produced
>> by Microsoft products (see Known Bugs).
>>
>
> Your issue doesn't have anything to do with this new setting.  That's
> about "unknown" XML attributes, elements and element content which isn't
> specified in the relevant XML schemas. That's at a much higher level of XML
> processing than your error...
>
>
>
> Their ACS url looks like this:
>
>  https://uofdepd.evidence.com/?class=UIX&proc=Login
>
>
> Upon restarting Jetty, errors appear because the xml parser sees "proc" as
> unexpected content and thinks a semicolon delimiter is required after it.
>
>
> Your error is that literal '&' characters aren't allowed in XML, period.
> The '&' is a special reserved character used to represent an 'entity',
> which is sort of like a macro that is replaced at parse time.  An entity
> always terminates with a ';', and it's not seeing a terminating ';',.  So
> that's literally what it is complaining about. It's fundamentally invalid
> XML. This is a very low-level XML parsing error, nothing to do with
> Shibboleth software choices, etc.
>
> For the correct way, see the wiki, which happens to have the correct
> example for your exact ACS issue:
>
>
> https://shibboleth.atlassian.net/wiki/spaces/CONCEPT/pages/928645443/MetadataCorrectness#MetadataCorrectness-EncodingofSpecialCharacters
>
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>


-- 

*Janemarie Duh*
UD Information Technologies
*Identity and Access Management Specialist*
duhj at udel.edu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250304/6ad54bc3/attachment.htm>