<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 8/25/17 1:20 PM, O'Dowd, Josh wrote:<br>
<br>
</div>
<blockquote type="cite"
cite="mid:6C4BCDAB7291C340B9D5C096C70C6C250145BCB0A8@UMMAIL02.gs.umt.edu"><br>
<pre wrap="">Actually, there is a SAMLRequest parameter that I missed, coming after the RelayState parameter, and now I see that only some of the failed requests have a leading RelayState parameter.
Sample access entry for failed request:
[25/Aug/2017:09:24:05 -0600] TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 "GET /idp/profile/SAML2/Redirect/SLO?RelayState=ss:m
em:18e8f777deec8579d5adfb48fbaf6d9ae296df30c777408c7058488b5509bd70&SAMLRequest=rVbJcqNIEL3rKxzqo8JmEwIUtiNYtLFoAyTBZaIExSKxiSoE6OsHd
dvT7e6ZCffEXLMyX+Z7mUnyjECaFGM9D/MKb+Glggg/NGmSofHXl5d+VWbjHKAYjTOQQjTG3tgUDX1MP5Hjosxx7uVJ/0Hp4uIM4DjPXvoRxgUaE0SSh3H2VKX4CfoVEfsF0Q
...
...
83szyP7Zvz5rr2fWBOi++VbZD5sXv+gu9+EI8OwggcBF7AM4I40oASK5T0B+EHwfjE/RL0bP/wBvf4J&SigAlg=<a class="moz-txt-link-freetext" href="http://www.w3.org/2000/09/xmldsig">http://www.w3.org/2000/09/xmldsig</a> HTTP/1.1" 40
0 18603
</pre>
</blockquote>
<br>
<br>
With the full request URL, specifically the SAMLRequest param (which
is the actual SAML protocol message), you can try decoding that with
one of the online SAML decoder/debugger services. I have used in
the past:<br>
<br>
<a class="moz-txt-link-freetext" href="https://rnd.feide.no/software/saml_2_0_debugger/">https://rnd.feide.no/software/saml_2_0_debugger/</a><br>
<br>
<br>
Also just found some others via googling, such as:<br>
<br>
<a class="moz-txt-link-freetext" href="https://www.samltool.com/decode.php">https://www.samltool.com/decode.php</a><br>
<br>
<br>
I'll be a little surprised if those can decode them though, and
OpenSAML can't, at least for valid inputs. The OpenSAML code has
essentially been in use for over a decade, and is not known to have
any issues with valid requests.<br>
<br>
Since this is the Redirect binding, what I would initially suspect
is that they aren't encoded properly, wrt to the Deflate part, i.e.
maybe it's just Base64-encoded and not Deflated. That's not valid
Redirect binding and OpenSAML would not handle and would treat as an
error. A decoder tool that attempts to dynamically support
Redirect and POST input simultaneously might be less strict. (I
think the FEIDE one does that). You could also try just handing the
SAMLRequest value to a Base64 decoder and see what happens. If it
works, then they aren't deflating.<br>
<br>
<br>
<br>
<br>
<br>
<br>
</body>
</html>