<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;
color:black;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";
color:black;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;
color:black;}
span.EmailStyle20
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:#1F497D;}
span.EmailStyle21
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor="white" lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Revisiting, from last week, we still have a persistent issue with these…<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">I finally was able to run a request from our httpd-access logs for a request where IdP erroring on the decoding. I would really appreciate if someone could take
a look at the error and the SAMLRequest parameter, decoded from the HTTPRequest that caused the error. Is it the HTTPRequest that the inflater is calling “invalid”, or the SAMLRequest portion<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">The error:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">ERROR [org.opensaml.profile.action.impl.DecodeMessage:73] - Profile Action DecodeMessage: Unable to decode
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">incoming requestorg.opensaml.messaging.decoder.MessageDecodingException: Error unmarshalling message from input stream<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> at org.opensaml.messaging.decoder.servlet.BaseHttpServletRequestXMLMessageDecoder.unmarshallMessage(BaseHttpServletRequestXML<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">MessageDecoder.java:158)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Caused by: net.shibboleth.utilities.java.support.xml.XMLParserException: Unable to read data from input stream<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> at net.shibboleth.utilities.java.support.xml.BasicParserPool.parse(BasicParserPool.java:251)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Caused by: java.util.zip.ZipException: invalid bit length repeat<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> at java.util.zip.InflaterInputStream.read(InflaterInputStream.java:164)<o:p></o:p></span></p>
<div style="mso-element:para-border-div;border:none;border-bottom:solid windowtext 1.0pt;padding:0in 0in 1.0pt 0in">
<p class="MsoNormal" style="border:none;padding:0in"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">The GET component of HTTPRequest from the httpd-access.log which caused the above error:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">GET /idp/profile/SAML2/Redirect/SLO?RelayState=ss:m<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">em:05c0926ff5a1aeef48539ddd0327319f47958d23259d1b1892b0c4f033af647a&SAMLRequest=rVbZcqtIEn3XVzjUjwq72BeF7QhAC7skJKHlpYOlQCWxiQIh+PpG9<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">9rT190zE+6Jec3KPJnnZCbJK/bSpBibeZzXlQOvNcTV0z1NMjz+8fI2rMtsnHsY4XHmpRCPq2C8lixzTL0Q46LMqzzIk+HTpI9DmVehPHsbnqqqwGMAkjxG2UudVi8wrAEKC9<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">AHRCiB4IFAAQeGqIRBBdbmYvikTd6Gv3tRyDM8DHnSgz5DeELIcV7giZChYeQFfu+GcQ21DFdeVr0NKYLknwnhmSI2FDWmmDFJH4dPLizxj0r6Iofvrw8m4x9x5S/c/js1D2N<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">YPugM3z/pYOz/i8z6hHw/T2B1esE4fwW/pPiZrxhP7xXMHmXg91cPJ/lYwm0WnMo8y2v8UcfD/j2Jx/Be9e49wnMfMwTvP3N+TfOjimkWlG1RwVCb/C9sX+8wC/4EmXiV9wHz<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">ePjZ3F6MpmleGvolL2NAEQQJCAb0Xr3Hb8OnTVvAbzhOE5jCrBq+D77k7Kuwel3z8ElK4rxE1Sn9BpgHMcVyz4Ef9NoMXkM8NmCrZVH+UXyI/wMIAQjxARJiFP/2N/o9yD9k/<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">39hU2LvOfdg8ZzGEVkMfxKaoLjfsm+ifaGFTx45/GdCPEQE/5bIJ0EFFSdYPubjq8X1khq+r5Gh2H5jXEZBEHiuVM+B79x2hS+6KAaIWSxjCtRkY+8LQVf55ZGaj7qRamrEYY<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">4zwN5YM5meLGxttWQwAS5ilvasvG2gPdvNpKNBZjtsnWTRmRsqE9OYFFnlupHWd0SzTb1pU4udiibPgFIoU5yjemTEeL6g24G8YavC1RTOkCyCSgx9XRLumi2L66JbTvO0zep<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Mke4dRN0MrHZgLrDbCtEicm/TNgjL2/zOk8YBXM6uPuhCWGkUpzaXDruFX04ZWRWgem4Yjtkuz8IEmZJz9XZkMq9sBaluOQm2UncskoMgOtcmY2TFvBm7jahaA+JeF+yRmZup<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">bSshbuqyHwlt5Z+1bXmlKNJy49NVenv7aMyvcg++2D6aAv42y/1X48/N+F4jGS28pbY6dZukaZ2zEROinjfK1SFc3jzrlqqMIkWX0mKa5qG9uHbKTCyS2Vxq/bnJgmVNmFzIZ<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">wbqMnrgqBk9mUUC19ykXLaSjt0GfsRrdpp2F0dfHnP1zIuWl1akfNtJa0/fbFuskNRVmM9FcqSf1Y1bkrPFDImD2uq6UwjSbVC4PiDJ484aARbt5KN4tLt2jU6laxtsDOVKnq<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">8Z6n5beLezdokOXnCoL2Z+T+JFvif3zroaNOTFivx7U9yL/v4cJTduJhxvryAR+BNHKyPGCRxma6z3FTPlnUY7XPPYNqYMi/WlqGf7wqNv16jl9tppoCWKoS7cliWlyabbLwv<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">BkO7TkbSX5kAt8nMT0KuZu5JTWfYavz0ndJZQ0eZQR0qsIaUVdC83JN1cXE/tAPGba7LNc0uPkz3eI0JV9MQ30mBinWkZFjtSOjAiks6ytF8eo34TkAFyeJKmOWiq7VqTjAuF<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Y/MQ77WBKWxAGnoHGxWySMsqu+2aWzPjq5i3gnxnS2R689yMiFacc3WWe11IjsvIaEsDHjcjVNUsv6jw5QzazXQQqsDUaQlMZByuTkbJs6lmbVbXE60W83PVaN1+VSzt6YiDz<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">fdm9q8j+2H86137PLFriB+XT8tCeH//3RN9QqA4loW0J3CBwPE8wXEswQccFElIf17ML1Gfxi9/QO9/AA==&SigAlg=http://www.w3.org/2000/09/xmldsig HTTP/1.1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">" 400 18603<o:p></o:p></span></p>
<div style="mso-element:para-border-div;border:none;border-bottom:solid windowtext 1.0pt;padding:0in 0in 1.0pt 0in">
<p class="MsoNormal" style="border:none;padding:0in"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">jordan91<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">The SAMLRequest parameter value from the above HTTPRequest which caused the above error. This was decoded using the http://rnd.feide.no/ SAML2 debugger tool:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><samlp:LogoutRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" Destination="https://{HOST}/idp/profile/SAML2/Redirect/SLO" ID="_afd747ed71aeb40a8d66aca9e43efacb"
IssueInstant="2017-08-20T22:24:13Z" Version="2.0"><saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://{HOST}/Shibboleth.sso</saml:Issuer><samlp:Extensions><aslo:Asynchronous xmlns:aslo="urn:oasis:names:tc:SAML:2.0:protocol:ext:async-slo"/></samlp:Extensions><saml:EncryptedID
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"><xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" Type="http://www.w3.org/2001/04/xmlenc#Element"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc"/><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><xenc:EncryptedKey xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"></xenc:EncryptionMethod><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><xenc:CipherData><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><xenc:CipherValue>SiKCNbwKk+cccaVAuG/bRvWpb9Vig/i4OPg2/u1wNXp8JH7PZ2G+z+HLI0YGsn/5v5LlEhMsMUIl<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">D/Vi4PNFrvTeNFWFAZK1nWsMhB9RGKH4g3s195CqTASxi35wuTymM5E9L74/r8rmsoiu+KgsGO3y<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">BT5tpVIC6KAM02lKJSr0VS5rpqOzPEomynunCAxzeizF/QW/G85Uti39iVvEycdrvGx71KY/kjVJ<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">zdetI26HwkzsVpbrE4BH8eHjw464UPj8DiLARqaW1lGtNCiHVrDcUAzZplY89Rqwn4BCLvKWT9HM<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">0xup5Z4GLmNNCdswur/04IQbjIUrq221MVghqA==</xenc:CipherValue><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"></xenc:CipherData><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"></xenc:EncryptedKey></ds:KeyInfo><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><xenc:CipherData><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><xenc:CipherValue>4IdvmNHEVwlwyRjKg09JowCqR0V7LjJMHC+fCJAmpEmodNOqzCF9plFGAybGL5/Pu0L6d7nKizn3<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">…<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">…<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">dH/LJ3A/DBsdQhKr75mIMTQqh3HpGjtwIzXQpPNE+6ew</xenc:CipherValue><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"></xenc:CipherData></xenc:EncryptedData></saml:EncryptedID><samlp:SessionIndex>_a9b082655e3a86c8677066507c6e91e3</samlp:SessionIndex></samlp:LogoutRequest><o:p></o:p></span></p>
</div>
</body>
</html>