<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Arial,Helvetica,sans-serif;" dir="ltr">
<p>Please ignore this message, we think it was caused by the following workday feature.</p>
<p><br>
</p>
<p></p>
<p style="margin-top: 10px; margin-right: 0px; margin-left: 0px; padding: 0px; color: rgb(51, 51, 51); font-family: Arial, sans-serif; font-size: 14px;">
<span class="nolink">You should also check the Do Not Deflate... option. Sending a POST request while deflating is not SAML compliant (their system is apparently providing options to send non-compliant messages to accomodate broken IdPs).</span></p>
<div><span class="nolink"><br>
</span></div>
<br>
<p></p>
<p><br>
</p>
<div id="Signature">
<div id="divtagdefaultwrapper" style="background-color: rgb(255, 255, 255); font-family: Calibri, Arial, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols;">
<div name="divtagdefaultwrapper" style="margin:0px">
<div style="background-color:rgb(255,255,255)">
<p class="x_MsoNormal" style="color:rgb(33,33,33); font-family:'Times New Roman',serif; font-size:12pt; margin:0in 0in 0pt; background-color:rgb(255,255,255)">
<span style="color:black; font-family:Calibri,sans-serif; font-size:10.5pt">Rhian Resnick</span></p>
<p class="x_MsoNormal" style="color:rgb(33,33,33); font-family:'Times New Roman',serif; font-size:16px; margin:0in 0in 0pt; background-color:rgb(255,255,255)">
<span style="color:black; font-family:Calibri,sans-serif; font-size:10.5pt">Assistant Director Middleware and HPC</span><span style="color:black; font-family:Calibri,sans-serif; font-size:11pt"></span></p>
<p class="x_MsoNormal" style="color:rgb(33,33,33); font-family:'Times New Roman',serif; font-size:16px; margin:0in 0in 0pt; background-color:rgb(255,255,255)">
<span style="color:black; font-family:Calibri,sans-serif; font-size:10.5pt">Office of Information Technology</span></p>
<p class="x_MsoNormal" style="color:rgb(33,33,33); font-family:'Times New Roman',serif; font-size:12pt; margin:0in 0in 0pt; background-color:rgb(255,255,255)">
<span style="color:black; font-family:Calibri,sans-serif; font-size:10.5pt"><br>
</span></p>
<p class="x_MsoNormal" style="color:rgb(33,33,33); font-family:'Times New Roman',serif; font-size:12pt; margin:0in 0in 0pt; background-color:rgb(255,255,255)">
<span style="color:black; font-family:Calibri,sans-serif; font-size:10.5pt">Florida Atlantic University</span><span style="color:black; font-family:Calibri,sans-serif; font-size:11pt"></span></p>
<p class="x_MsoNormal" style="color:rgb(33,33,33); font-family:'Times New Roman',serif; font-size:12pt; margin:0in 0in 0pt; background-color:rgb(255,255,255)">
<span style="color:black; font-family:Calibri,sans-serif; font-size:10.5pt">777 Glades Road, CM22, Rm 173B</span><span style="color:black; font-family:Calibri,sans-serif; font-size:11pt"></span></p>
<p class="x_MsoNormal" style="color:rgb(33,33,33); font-family:'Times New Roman',serif; font-size:12pt; margin:0in 0in 0pt; background-color:rgb(255,255,255)">
<span style="color:black; font-family:Calibri,sans-serif; font-size:10.5pt">Boca Raton, FL 33431</span><span style="color:black; font-family:Calibri,sans-serif; font-size:11pt"></span></p>
<p class="x_MsoNormal" style="color:rgb(33,33,33); font-family:'Times New Roman',serif; font-size:12pt; margin:0in 0in 0pt; background-color:rgb(255,255,255)">
<span style="color:black; font-family:Calibri,sans-serif; font-size:10.5pt">Phone 561.297.2647</span><span style="color:black; font-family:Calibri,sans-serif; font-size:11pt"></span></p>
<p class="x_MsoNormal" style="color:rgb(33,33,33); font-family:'Times New Roman',serif; font-size:12pt; margin:0in 0in 0pt; background-color:rgb(255,255,255)">
<span style="color:black; font-family:Calibri,sans-serif; font-size:10.5pt">Fax 561.297.0222</span></p>
<p class="x_MsoNormal" style="color:rgb(33,33,33); font-family:'Times New Roman',serif; font-size:12pt; margin:0in 0in 0pt; background-color:rgb(255,255,255)">
<span style="color:black; font-family:Calibri,sans-serif; font-size:10.5pt"> </span><span style="color:rgb(31,73,125); font-family:Calibri,sans-serif; font-size:11pt"><a href="https://hpc.fau.edu/wp-content/uploads/2015/01/image.jpg" style="border:0px; font-family:Arial,Helvetica,sans-serif; font-size:13px; line-height:21px; margin:0px; padding:0px; vertical-align:baseline; color:rgb(0,102,204); text-decoration:none; background-color:rgb(239,239,239)" id="LPNoLP"><img alt="image" class="alignnone size-full wp-image-498" style="border: 0px; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 5px; padding: 0px; vertical-align: middle; max-width: 100%; width: 195px; user-select: none;" src="http://hpc.fau.edu/wp-content/uploads/2015/01/image.jpg"></a></span></p>
</div>
</div>
</div>
</div>
<br>
<br>
<div style="color: rgb(0, 0, 0);">
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Rhian Resnick<br>
<b>Sent:</b> Thursday, June 15, 2017 10:22 AM<br>
<b>To:</b> Shib Users<br>
<b>Cc:</b> Carolina Schultz De Oliveira<br>
<b>Subject:</b> issue with workday and /idp/profile/SAML2/POST/SSO</font>
<div> </div>
</div>
<div>
<div id="divtagdefaultwrapper" dir="ltr" style="font-size:12pt; color:rgb(0,0,0); font-family:Calibri,Arial,Helvetica,sans-serif,EmojiFont,"Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols">
<p></p>
<div>We are getting an interesting error form Shibboleth 3.3.1 when authenticating to Workday. Turns out we made a mistake in our configuration of the production IDP and Workday and were forwarding authentications to the redirect profile instead of the post
profile (the redirect profile rejects the post requests in version 3.3.1)</div>
<div><br>
</div>
<div>I confirmed I can decode the saml request but for some reason we are getting the following error from the IDP stating it cannot decode the message. </div>
<div><br>
</div>
<div><br>
</div>
<div>Here is a request to POST and a sample of the error message.</div>
<div><br>
</div>
<div><br>
</div>
<div>Request URL:https://sso.fau.edu/idp/profile/SAML2/POST/SSO</div>
<div>Request Method:POST</div>
<div>Status Code:200 OK</div>
<div>Remote Address:131.91.101.225:443</div>
<div>Referrer Policy:no-referrer-when-downgrade</div>
<div>Response Headers</div>
<div>view source</div>
<div>Cache-Control:no-cache, no-store, must-revalidate, max-age=0</div>
<div>Connection:close</div>
<div>Content-Length:2479</div>
<div>Content-Type:text/html;charset=ISO-8859-1</div>
<div>Date:Thu, 15 Jun 2017 13:12:58 GMT</div>
<div>Expires:0</div>
<div>Pragma:no-cache</div>
<div>Request Headers</div>
<div>view source</div>
<div>Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8</div>
<div>Accept-Encoding:gzip, deflate, br</div>
<div>Accept-Language:en-US,en;q=0.8</div>
<div>Cache-Control:max-age=0</div>
<div>Connection:keep-alive</div>
<div>Content-Length:430</div>
<div>Content-Type:application/x-www-form-urlencoded</div>
<div>Cookie:JSESSIONID=FA01B0D5DCAFA27C7D95C9F75C3CE05C; shib_idp_session=7e2466d44c74cbf429e836b6ab53c992a96f895899e3883811bd5c698562b8d0; _idp_session=NzYuMjYuNS45NA%3D%3D%7CLQ%3D%3D%7CMGM0NjVhMDY3MTIyZTUyYjAzMWJkNDQ3ZmFmZWVlZWUyZTdlMDlmZDJhZjI1MWExNWNhMDZhNzQ2OGQ1OWZiNg%3D%3D%7Czghr6IF9DYrIR8rQLQnD89TmH1g%3D;
JSESSIONID=F225696A1585DA7202979002D8D53495; BIGipServerPROD_mwp1_shib_443_pool=1932530442.47873.0000; BIGipServerPROD_mwp1_cas_443_pool=1865421578.47873.0000; BIGipServerTEST_mwp1_shib_443_pool=1966084874.47873.0000; _ga=GA1.2.1239512240.1497057820; fos.web.server=mcportal2;
fos.secure.web.server=mcportal2; runId=-4137272902464538516; JSESSIONID=DA21105A217125AEA52D8838F996302A; CASTGC=TGT-379342-P65Jb3iGTcmf4fFy9Bdaj3tc7C7isJ21TGLM3w4L5SfXua1Z1y-cas1.fau.edu</div>
<div>DNT:1</div>
<div>Host:sso.fau.edu</div>
<div>Origin:https://impl.workday.com</div>
<div>Referer:https://impl.workday.com/wday/authgwy/fau/login-saml2.htmld</div>
<div>Upgrade-Insecure-Requests:1</div>
<div>User-Agent:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.86 Safari/537.36</div>
<div>Form Data</div>
<div>view source</div>
<div>view URL encoded</div>
<div>SAMLRequest:fZFBT4NAEIXv/gqy94UFSlsmhabGNDbRSCx68GKWZbFE2K07S6n/XqQa66XHmcy8976ZxfLYNs5B</div>
<div>Gqy1SojvMuJIJXRZq7eEPOVrOifL9GqBvG32sOrsTj3Kj06iddbaCDl2ElLxBiVxNjcJeZ3xkFVx</div>
<div>UdCwjAWdTOclLcqCUSbiSSSkqKo4HkYx44j1Qf4tI3Zyo9ByZRMSMH9G2ZT6Ue6H4AcQzV3G2Atx</div>
<div>MqOtFrq5rtUpZWcUaI41guKtRLACtqv7OwhcBsVpCOE2zzOaPWxz4jz/0gbftAO/Qhj5Lkvtf3xJ</div>
<div>Ol4jgDGwORMILgsMvNLYwZmkO2v34Hl937u9Nu8l/3SFbr2Kd8hVWejjwjv3SE/l/wekXw==</div>
<div><br>
</div>
<div><b>idp-process.log</b></div>
<div><br>
</div>
<div>
<div>2017-06-15 09:46:51,448 - WARN [org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event occurred while processing the request: UnableToDecode</div>
<div>2017-06-15 09:46:51,448 - DEBUG [org.opensaml.saml.common.profile.logic.DefaultLocalErrorPredicate:154] - No SAMLBindingContext or binding URI available, error must be handled locally</div>
<div>2017-06-15 09:46:55,040 - DEBUG [org.opensaml.saml.saml2.binding.decoding.impl.HTTPPostDecoder:86] - Decoded SAML relay state of: null</div>
<div>2017-06-15 09:46:55,040 - DEBUG [org.opensaml.saml.saml2.binding.decoding.impl.HTTPPostDecoder:109] - Getting Base64 encoded message from request</div>
<div>2017-06-15 09:46:55,042 - ERROR [org.opensaml.messaging.decoder.servlet.BaseHttpServletRequestXMLMessageDecoder:157] - Error unmarshalling message from input stream</div>
<div>net.shibboleth.utilities.java.support.xml.XMLParserException: Unable to read data from input stream</div>
<div><span style="white-space:pre"></span>at net.shibboleth.utilities.java.support.xml.BasicParserPool.parse(BasicParserPool.java:251)</div>
<div>Caused by: com.sun.org.apache.xerces.internal.impl.io.MalformedByteSequenceException: Invalid byte 1 of 1-byte UTF-8 sequence.</div>
<div><span style="white-space:pre"></span>at com.sun.org.apache.xerces.internal.impl.io.UTF8Reader.invalidByte(UTF8Reader.java:701)</div>
<div>2017-06-15 09:46:55,044 - ERROR [org.opensaml.profile.action.impl.DecodeMessage:73] - Profile Action DecodeMessage: Unable to decode incoming request</div>
<div>org.opensaml.messaging.decoder.MessageDecodingException: Error unmarshalling message from input stream</div>
<div><span style="white-space:pre"></span>at org.opensaml.messaging.decoder.servlet.BaseHttpServletRequestXMLMessageDecoder.unmarshallMessage(BaseHttpServletRequestXMLMessageDecoder.java:158)</div>
<div>Caused by: net.shibboleth.utilities.java.support.xml.XMLParserException: Unable to read data from input stream</div>
<div><span style="white-space:pre"></span>at net.shibboleth.utilities.java.support.xml.BasicParserPool.parse(BasicParserPool.java:251)</div>
<div>Caused by: com.sun.org.apache.xerces.internal.impl.io.MalformedByteSequenceException: Invalid byte 1 of 1-byte UTF-8 sequence.</div>
<div><span style="white-space:pre"></span>at com.sun.org.apache.xerces.internal.impl.io.UTF8Reader.invalidByte(UTF8Reader.java:701)</div>
<div>2017-06-15 09:46:55,044 - WARN [org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event occurred while processing the request: UnableToDecode</div>
<div>2017-06-15 09:46:55,045 - DEBUG [org.opensaml.saml.common.profile.logic.DefaultLocalErrorPredicate:154] - No SAMLBindingContext or binding URI available, error must be handled locally</div>
<div><br>
</div>
<br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>Here is a post to the Redirect profile.</div>
<div><br>
</div>
<div>Request URL:https://sso.fau.edu/idp/profile/SAML2/Redirect/SSO</div>
<div>Request Method:POST</div>
<div>Status Code:302 Found</div>
<div>Remote Address:131.91.101.225:443</div>
<div>Referrer Policy:no-referrer-when-downgrade</div>
<div>Response Headers</div>
<div>view source</div>
<div>Cache-Control:no-cache, no-store, must-revalidate, max-age=0</div>
<div>Connection:close</div>
<div>Content-Length:0</div>
<div>Content-Type:text/plain; charset=UTF-8</div>
<div>Date:Thu, 15 Jun 2017 13:28:58 GMT</div>
<div>Expires:0</div>
<div>Location:https://sso.fau.edu:443/idp/AuthnEngine</div>
<div>Pragma:no-cache</div>
<div>Set-Cookie:_idp_authn_lc_key=df4a00a4ce21e25a1aca39e11742a8eb15a3eb9641ee76cf9eaa1abf388e7fb3; Version=1; Path=/idp; Secure</div>
<div>Request Headers</div>
<div>view source</div>
<div>Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8</div>
<div>Accept-Encoding:gzip, deflate, br</div>
<div>Accept-Language:en-US,en;q=0.8</div>
<div>Cache-Control:max-age=0</div>
<div>Connection:keep-alive</div>
<div>Content-Length:438</div>
<div>Content-Type:application/x-www-form-urlencoded</div>
<div>Cookie:JSESSIONID=FA01B0D5DCAFA27C7D95C9F75C3CE05C; shib_idp_session=7e2466d44c74cbf429e836b6ab53c992a96f895899e3883811bd5c698562b8d0; JSESSIONID=F225696A1585DA7202979002D8D53495; _idp_session=NzMuODUuMjA1Ljk1%7CLQ%3D%3D%7CYzY1ZTY0YmM4YzdmY2RkYjkxOGQ3YTI2OTI3ZDI0YTVjM2NmNTNhNThlNDM1N2ZiMGU4MzFiNDY0ZmVkZTAzZQ%3D%3D%7CsK%2BQmlF1y1Wpf2OXy3O2pxzsqKk%3D;
BIGipServerPROD_mwp1_shib_443_pool=1932530442.47873.0000; BIGipServerPROD_mwp1_cas_443_pool=1865421578.47873.0000; BIGipServerTEST_mwp1_shib_443_pool=1966084874.47873.0000; _ga=GA1.2.1239512240.1497057820; fos.web.server=mcportal2; fos.secure.web.server=mcportal2;
runId=-4137272902464538516; JSESSIONID=2EB99FA2AB9F37BD2EBDCA87BE2F9F19; CASTGC=TGT-381344-grQieUFcydcXwgzoo5m0AoiiJb3pG1HsFLaw4rYKMzcdUSsvVQ-cas1.fau.edu</div>
<div>DNT:1</div>
<div>Host:sso.fau.edu</div>
<div>Origin:https://impl.workday.com</div>
<div>Referer:https://impl.workday.com/wday/authgwy/fau/login-saml2.htmld</div>
<div>Upgrade-Insecure-Requests:1</div>
<div>User-Agent:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.86 Safari/537.36</div>
<div>Form Data</div>
<div>view source</div>
<div>view URL encoded</div>
<div>SAMLRequest:fZHRT4MwEMbf/StI3wu0hQ2bwTJjFpdoJA598MV0pTgitLNXxvzvZUzjfNnjXe6+7/vdzeaHtvH2</div>
<div>ykJtdIqIHyJPaWnKWr+n6LlY4gTNs6sZiLbZ8UXntvpJfXYKnLc0Vqqxk6JKNKCQt7pN0VtZlkxV</div>
<div>aoJZRSSOIsqwIDLBIYuYjCMRT5PjKOQCoN6rv2WATq00OKFdimhIpjicYBIXhHGa8HjqXzPyirzc</div>
<div>GmekaW5qfUrZWc2NgBq4Fq0C7iRfLx7uOfVDvjkNAb8rihznj+sCeS+/tPRIO/Br4CPfZandjy/K</div>
<div>xmtQPga2ZwL0ssDAq6wbnFG2dW7Hg6Dve7839qMUX740bVCJDoQuN+YwC849slP5/wHZNw==</div>
<br>
<p></p>
<p><br>
</p>
<div id="Signature">
<div id="divtagdefaultwrapper" style="background-color:rgb(255,255,255); font-family:Calibri,Arial,Helvetica,sans-serif,EmojiFont,"Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols,EmojiFont,"Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols,EmojiFont,"Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols">
<div name="divtagdefaultwrapper" style="margin:0px">
<div style="background-color:rgb(255,255,255)">
<p class="x_MsoNormal" style="color:rgb(33,33,33); font-family:'Times New Roman',serif; font-size:12pt; margin:0in 0in 0pt; background-color:rgb(255,255,255)">
<span style="color:black; font-family:Calibri,sans-serif; font-size:10.5pt">Rhian Resnick</span></p>
<p class="x_MsoNormal" style="color:rgb(33,33,33); font-family:'Times New Roman',serif; font-size:16px; margin:0in 0in 0pt; background-color:rgb(255,255,255)">
<span style="color:black; font-family:Calibri,sans-serif; font-size:10.5pt">Assistant Director Middleware and HPC</span><span style="color:black; font-family:Calibri,sans-serif; font-size:11pt"></span></p>
<p class="x_MsoNormal" style="color:rgb(33,33,33); font-family:'Times New Roman',serif; font-size:16px; margin:0in 0in 0pt; background-color:rgb(255,255,255)">
<span style="color:black; font-family:Calibri,sans-serif; font-size:10.5pt">Office of Information Technology</span></p>
<p class="x_MsoNormal" style="color:rgb(33,33,33); font-family:'Times New Roman',serif; font-size:12pt; margin:0in 0in 0pt; background-color:rgb(255,255,255)">
<span style="color:black; font-family:Calibri,sans-serif; font-size:10.5pt"><br>
</span></p>
<p class="x_MsoNormal" style="color:rgb(33,33,33); font-family:'Times New Roman',serif; font-size:12pt; margin:0in 0in 0pt; background-color:rgb(255,255,255)">
<span style="color:black; font-family:Calibri,sans-serif; font-size:10.5pt">Florida Atlantic University</span><span style="color:black; font-family:Calibri,sans-serif; font-size:11pt"></span></p>
<p class="x_MsoNormal" style="color:rgb(33,33,33); font-family:'Times New Roman',serif; font-size:12pt; margin:0in 0in 0pt; background-color:rgb(255,255,255)">
<span style="color:black; font-family:Calibri,sans-serif; font-size:10.5pt">777 Glades Road, CM22, Rm 173B</span><span style="color:black; font-family:Calibri,sans-serif; font-size:11pt"></span></p>
<p class="x_MsoNormal" style="color:rgb(33,33,33); font-family:'Times New Roman',serif; font-size:12pt; margin:0in 0in 0pt; background-color:rgb(255,255,255)">
<span style="color:black; font-family:Calibri,sans-serif; font-size:10.5pt">Boca Raton, FL 33431</span><span style="color:black; font-family:Calibri,sans-serif; font-size:11pt"></span></p>
<p class="x_MsoNormal" style="color:rgb(33,33,33); font-family:'Times New Roman',serif; font-size:12pt; margin:0in 0in 0pt; background-color:rgb(255,255,255)">
<span style="color:black; font-family:Calibri,sans-serif; font-size:10.5pt">Phone 561.297.2647</span><span style="color:black; font-family:Calibri,sans-serif; font-size:11pt"></span></p>
<p class="x_MsoNormal" style="color:rgb(33,33,33); font-family:'Times New Roman',serif; font-size:12pt; margin:0in 0in 0pt; background-color:rgb(255,255,255)">
<span style="color:black; font-family:Calibri,sans-serif; font-size:10.5pt">Fax 561.297.0222</span></p>
<p class="x_MsoNormal" style="color:rgb(33,33,33); font-family:'Times New Roman',serif; font-size:12pt; margin:0in 0in 0pt; background-color:rgb(255,255,255)">
<span style="color:black; font-family:Calibri,sans-serif; font-size:10.5pt"> </span><span style="color:rgb(31,73,125); font-family:Calibri,sans-serif; font-size:11pt"><a href="https://hpc.fau.edu/wp-content/uploads/2015/01/image.jpg" id="LPNoLP" style="border:0px; font-family:Arial,Helvetica,sans-serif; font-size:13px; line-height:21px; margin:0px; padding:0px; vertical-align:baseline; color:rgb(0,102,204); text-decoration:none; background-color:rgb(239,239,239)"><img alt="image" class="alignnone size-full wp-image-498" style="border: 0px; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 5px; padding: 0px; vertical-align: middle; max-width: 100%; width: 195px; user-select: none;" src="http://hpc.fau.edu/wp-content/uploads/2015/01/image.jpg"></a></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>