<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 5/22/17 10:05 AM, James McClune
wrote:<br>
</div>
<blockquote type="cite" cite="mid:1495461952.10245.1@smtp.gmail.com"><br>
<div>xmltooling::XMLParserException</div>
<div>xmltooling::XMLParserException at (<a
href="https://sp.testshib.org/Shibboleth.sso/SAML2/POST"
moz-do-not-send="true">https://sp.testshib.org/Shibboleth.sso/SAML2/POST</a>)
XML error(s) during parsing, check log for specifics</div>
</blockquote>
<br>
That's the Shib SP telling you there is a fundamental XML parsing
error on the POST of the Response+Assertion to the SP's assertion
consumer service (ACS) endpoint. The real info is at the end:<br>
<br>
<blockquote type="cite" cite="mid:1495461952.10245.1@smtp.gmail.com">
<div><b>2017-05-22 09:42:10 ERROR XMLTooling.ParserPool [1440]:
fatal error on line 9, column 6612, message: invalid character
0x1</b><br>
</div>
</blockquote>
<br>
That's exactly where the invalid XML is, specifically an invalid
character. If you actually pull that XML into a text editor and
find line 9 col 6612 (with some guesstimation to account for
formatting differences), you will see that there is some control
character there being sent as the value of an attribute:<br>
<br>
<tt><saml:Attribute Name="objectSid"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue
xsi:type="xs:string">CONTROL CHAR
HERE</saml:AttributeValue></saml:Attribute></tt><br>
<br>
<br>
Depending on what text editor etc you are using, it may be difficult
to see, but in my MacVIM that location shows as a ^E, and 'od' shows
the same:<br>
<br>
<tt>0000000 < s a m l : A t t r i b
u t e </tt><tt><br>
</tt><tt>0000020 N a m e = " o b j e c t
S i d "</tt><tt><br>
</tt><tt>0000040 N a m e F o r m a t =
" u r n</tt><tt><br>
</tt><tt>0000060 : o a s i s : n a m e s
: t c :</tt><tt><br>
</tt><tt>0000100 S A M L : 2 . 0 : a t t
r n a m</tt><tt><br>
</tt><tt>0000120 e - f o r m a t : b a s
i c " ></tt><tt><br>
</tt><tt>0000140 < s a m l : A t t r i
b u t e V</tt><tt><br>
</tt><tt>0000160 a l u e x s i : t y p
e = " x</tt><tt><br>
</tt><tt>0000200 s : s t r i n g " > 005
< / s a m</tt><tt><br>
</tt><tt>0000220 l : A t t r i b u t e V
a l u e</tt><tt><br>
</tt><tt>0000240 > < / s a m l : A t
t r i b u t</tt><tt><br>
</tt><tt>0000260 e >
\n </tt><tt><br>
</tt><tt>0000263</tt><br>
<br>
<br>
So whatever you are doing in the IdP to produce the objectSid
attribute is producing an illegal value, probably something binary.
IIRC some of the attribs in AD are binary in nature and require
special handling to render them as a SAML attribute. But you'd have
to ask the SimpleSAMLPHP people about specifics for their software.
<br>
</body>
</html>