<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">Attempting to provide SSO for a vended hosted service using SAML in .net environment (Origami Risk),<div>Shibboleth IdP is unable to parse the authentication request.</div><div><br></div><div>The incoming SAML request according to the vendor is:</div><div><br></div><div><div><font face="Courier New"><?xml version="1.0" encoding="UTF-8"?><samlp:AuthnRequest ID="_4241073183472CBDEA1BB2FCE42AB2E2" Version="2.0" IssueInstant="2014-02-05T00:55:15Z" Destination="<a href="https://idp.alaska.edu/idp/profile/SAML2/Redirect/SSO">https://idp.alaska.edu/idp/profile/SAML2/Redirect/SSO</a>" ForceAuthn="false" IsPassive="false" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" AssertionConsumerServiceURL="<a href="https://idp.alaska.edu/idp/profile/SAML2/Redirect/SSO">https://idp.alaska.edu/idp/profile/SAML2/Redirect/SSO</a>" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"></font></div><div><font face="Courier New"> <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"><a href="https://demo.origamirisk.com">https://demo.origamirisk.com</a></saml:Issuer><br></font></div><div><font face="Courier New"> <samlp:NameIDPolicy AllowCreate="true" /><br></font></div><div><font face="Courier New"></samlp:AuthnRequest></font></div></div><div><br></div><div>The AssertionConsumerServiceURL seems bogus, but the IdP doesn’t seem to have gotten far enough to be bothered by that:</div><div><font face="Courier New"><br></font></div><div>The IdP error log indicates inability to parse the XML, but is not helping me tell the vendor what to do differently:</div><div><br></div><div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 244, 156);">10:59:22.562 - INFO [Shibboleth-Access:73] - 20140205T195922Z|69.121.192.240|<a href="http://idp.alaska.edu">idp.alaska.edu</a>:443|/profile/SAML2/Redirect/SSO|</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 244, 156);">10:59:22.563 - <span style="background-color: #e6e600">ERROR</span> [org.opensaml.ws.message.decoder.BaseMessageDecoder:207] - Encountered error parsing message into its DOM representation</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 244, 156);">org.opensaml.xml.parse.XMLParserException: Unable to read XML from input stream</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 244, 156);"> at org.opensaml.xml.parse.BasicParserPool.parse(BasicParserPool.java:220) ~[xmltooling-1.3.2.jar:na]</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 244, 156);"> at org.opensaml.ws.message.decoder.BaseMessageDecoder.unmarshallMessage(BaseMessageDecoder.java:185) [openws-1.4.2.jar:na]</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 244, 156);"> at org.opensaml.saml2.binding.decoding.HTTPRedirectDeflateDecoder.doDecode(HTTPRedirectDeflateDecoder.java:101) [opensaml-2.5.0.jar:na]</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 244, 156);"> at org.opensaml.ws.message.decoder.BaseMessageDecoder.decode(BaseMessageDecoder.java:78) [openws-1.4.2.jar:na]</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 244, 156);"> at org.opensaml.saml2.binding.decoding.BaseSAML2MessageDecoder.decode(BaseSAML2MessageDecoder.java:69) [opensaml-2.5.0.jar:na]</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 244, 156);"> at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.decodeRequest(SSOProfileHandler.java:331) [shibboleth-identityprovider-2.3.0.jar:na]</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 244, 156);"> at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.performAuthentication(SSOProfileHandler.java:189) [shibboleth-identityprovider-2.3.0.jar:na]</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 244, 156);"> at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:160) [shibboleth-identityprovider-2.3.0.jar:na]</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 244, 156);"> at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:87) [shibboleth-identityprovider-2.3.0.jar:na]</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 244, 156);"> at edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet.service(ProfileRequestDispatcherServlet.java:83) [shibboleth-common-1.3.0.jar:na]</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 244, 156);"> at javax.servlet.http.HttpServlet.service(HttpServlet.java:717) [servlet-api.jar:na]</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 244, 156);"> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) [catalina.jar:6.0.32]</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 244, 156);"> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.32]</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 244, 156);"> at edu.internet2.middleware.shibboleth.idp.util.NoCacheFilter.doFilter(NoCacheFilter.java:49) [shibboleth-identityprovider-2.3.0.jar:na]</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 244, 156);"> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:6.0.32]</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 244, 156);"> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.32]</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 244, 156);"> at edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter.doFilter(IdPSessionFilter.java:80) [shibboleth-identityprovider-2.3.0.jar:na]</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 244, 156);"> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:6.0.32]</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 244, 156);"> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.32]</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 244, 156);"> at edu.internet2.middleware.shibboleth.common.log.SLF4JMDCCleanupFilter.doFilter(SLF4JMDCCleanupFilter.java:51) [shibboleth-common-1.3.0.jar:na]</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 244, 156);"> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:6.0.32]</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 244, 156);"> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.32]</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 244, 156);"> at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) [catalina.jar:6.0.32]</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 244, 156);"> at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191) [catalina.jar:6.0.32]</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 244, 156);"> at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127) [catalina.jar:6.0.32]</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 244, 156);"> at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) [catalina.jar:6.0.32]</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 244, 156);"> at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:554) [catalina.jar:6.0.32]</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 244, 156);"> at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) [catalina.jar:6.0.32]</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 244, 156);"> at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:298) [catalina.jar:6.0.32]</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 244, 156);"> at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:859) [tomcat-coyote.jar:6.0.32]</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 244, 156);"> at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:588) [tomcat-coyote.jar:6.0.32]</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 244, 156);"> at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489) [tomcat-coyote.jar:6.0.32]</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 244, 156);"> at java.lang.Thread.run(Thread.java:662) [na:1.6.0_45]</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 244, 156);">Caused by: java.util.zip.ZipException: too many length or distance symbols</div></div><div>…</div><div><br></div><div>The SAML post (also provided by the vendor) is:</div><div><br></div><div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(255, 147, 0);"><span style="color: #091480"><html </span><span style="color: #4b5a7d">xmlns=</span>"<a href="http://www.w3.org/1999/xhtml">http://www.w3.org/1999/xhtml</a>"<span style="color: #091480">><body </span><span style="color: #098021">onload=</span>"document.forms.theform.submit()"<span style="color: #091480">><noscript><p></span><span style="color: #323333">Please press the Continue button to proceed.</span><span style="color: #091480"></p></noscript><form </span><span style="color: #098021">id=</span>"theform"<span style="color: #091480"> </span><span style="color: #098021">action=</span>"<a href="https://idp.alaska.edu/idp/profile/SAML2/Redirect/SSO">https://idp.alaska.edu/idp/profile/SAML2/Redirect/SSO</a>"<span style="color: #091480"> </span><span style="color: #098021">method=</span>"post"<span style="color: #091480">><div><input </span><span style="color: #098021">type=</span>"hidden"<span style="color: #091480"> </span><span style="color: #098021">name=</span>"SAMLRequest"<span style="color: #091480"> </span><span style="color: #098021">value=</span>"PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48c2FtbHA6QXV0aG5SZXF1ZXN0IElEPSJfNDI0MTA3MzE4MzQ3MkNCREVBMUJCMkZDRTQyQUIyRTIiIFZlcnNpb249IjIuMCIgSXNzdWVJbnN0YW50PSIyMDE0LTAyLTA1VDAwOjU1OjE1WiIgRGVzdGluYXRpb249Imh0dHBzOi8vaWRwLmFsYXNrYS5lZHUvaWRwL3Byb2ZpbGUvU0FNTDIvUmVkaXJlY3QvU1NPIiBGb3JjZUF1dGhuPSJmYWxzZSIgSXNQYXNzaXZlPSJmYWxzZSIgUHJvdG9jb2xCaW5kaW5nPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YmluZGluZ3M6SFRUUC1QT1NUIiBBc3NlcnRpb25Db25zdW1lclNlcnZpY2VVUkw9Imh0dHBzOi8vaWRwLmFsYXNrYS5lZHUvaWRwL3Byb2ZpbGUvU0FNTDIvUmVkaXJlY3QvU1NPIiB4bWxuczpzYW1scD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOnByb3RvY29sIj48c2FtbDpJc3N1ZXIgeG1sbnM6c2FtbD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFzc2VydGlvbiI+aHR0cHM6Ly9kZW1vLm9yaWdhbWlyaXNrLmNvbTwvc2FtbDpJc3N1ZXI+PHNhbWxwOk5hbWVJRFBvbGljeSBBbGxvd0NyZWF0ZT0idHJ1ZSIgLz48L3NhbWxwOkF1dGhuUmVxdWVzdD4="<span style="color: #091480">/></div><noscript><div><input </span><span style="color: #098021">type=</span>"submit"<span style="color: #091480"> </span><span style="color: #098021">value=</span>"Continue"<span style="color: #091480">/></div></noscript></form></body></html></span></div></div><div style="margin: 0px; font-size: 13px; font-family: 'Lucida Sans'; color: rgb(255, 147, 0);"><br></div><div style="margin: 0px;"><br></div></body></html>