<div dir="ltr"><div>Good Afternoon,</div><div><br></div><div>We are running Shibboleth IdP v5.1.2 with Jetty 12.0.14 and Amazon Corretto 17.0.14.7.1 and the default of Strict for entity resolution. To refresh memories, the strict default was new with IdPv5:</div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Helvetica"><span class="gmail-s1" style="font-kerning:none">The XML processing code in OpenSAML has been enhanced to support a more strict form of processing that rejects unexpected/unknown XML Attributes, Elements, and even stray characters inside elements. Older versions tended to ignore them. In the vast majority of cases, rejecting such content is desirable but it is possible to turn off this processing mode by setting the property <b>opensaml.config.xml.unmarshall.strictMode</b> to “false”. Note that this setting appears to reject otherwise valid metadata produced by Microsoft products (see Known Bugs).</span></p></blockquote><div><br></div><div>The problem: I have an SP that does SAML but doesn't play with Shib nicely. Their ACS url looks like this:</div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> <a href="https://uofdepd.evidence.com/?class=UIX&proc=Login">https://uofdepd.evidence.com/?class=UIX&proc=Login</a></blockquote><div><br></div><div>Upon restarting Jetty, errors appear because the xml parser sees "proc" as unexpected content and thinks a semicolon delimiter is required after it. I confirmed this by validating the xml and editing my cobbled together metadata until it validated. A relevant portion of the log is below my sig. </div><div><br></div><div>Has anyone run into this? Is there a way to get around it besides changing strict to false?</div><div><br></div><div> Janemarie</div>
<div><br></div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Caused by: net.shibboleth.shared.resolver.ResolverException: Exception during refresh<br> at org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver.refresh(AbstractReloadingMetadataResolver.java:398)<br>Caused by: net.shibboleth.shared.resolver.ResolverException: Unable to unmarshall metadata<br> at org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver.unmarshallMetadata(AbstractReloadingMetadataResolver.java:494)<br>Caused by: org.opensaml.core.xml.io.UnmarshallingException: net.shibboleth.shared.xml.XMLParserException: Unable to parse inputstream, it contained invalid XML<br> at org.opensaml.saml.metadata.resolver.impl.AbstractMetadataResolver.unmarshallMetadata(AbstractMetadataResolver.java:442)<br>Caused by: net.shibboleth.shared.xml.XMLParserException: Unable to parse inputstream, it contained invalid XML<br> at net.shibboleth.shared.xml.impl.BasicParserPool.parse(BasicParserPool.java:245)<br>Caused by: org.xml.sax.SAXParseException: The reference to entity "proc" must end with the ';' delimiter.<br> at java.xml/com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.createSAXParseException(ErrorHandlerWrapper.java:204)<br>2025-03-04 13:44:05,225 - ERROR [net.shibboleth.shared.service.AbstractReloadableService:183] - Service 'shibboleth.MetadataResolverService': No further attempts will be made to reload - </blockquote><div><br></div><div><br></div><span class="gmail_signature_prefix">-- </span><br><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><b><span style="color:rgb(11,83,148)"><span style="background-color:rgb(255,255,255)"><span style="font-family:monospace"><img src="https://ci3.googleusercontent.com/mail-sig/AIorK4zpRbtQKEfumFa024uUvgVX6y-TmDvn0IU1RsgcUZgQdNxzrpusMRfxo-LMo1knzn-fSC7LFRE"><br></span></span></span></b></div><div><font size="2"><span style="color:rgb(11,83,148)"><b><b><span style="font-size:11.5pt;line-height:105%;font-family:"Arial",sans-serif;color:rgb(0,83,159)">Janemarie Duh</span></b></b></span></font></div><div><font color="#888888"><font size="2"><span style="color:rgb(11,83,148)"><span style="font-size:11.5pt;line-height:105%;font-family:"Arial",sans-serif;color:rgb(0,83,159)"><span style="font-size:10pt;line-height:105%;color:rgb(10,10,10)">UD Information Technologies</span></span></span></font></font></div><div><span style="color:rgb(11,83,148)"><i><span style="color:rgb(0,0,0)">Identity and Access Management Specialist</span></i><b><br></b></span></div><div><span style="color:rgb(11,83,148)"><a href="mailto:duhj@udel.edu" target="_blank"><span style="color:rgb(0,0,0)">duhj@udel.edu</span></a><b><br></b></span></div></div></div></div>