SAML Response processing fails on parsing - spring-security

Question

I am trying to get Spring SAML to work with Idp-initiated scenario. I am getting exception when processing the SAML response message within the sample application. However when I parse the same response with simple Java code, everything goes well and I can get it parsed successfully. Any clue if there is some configuration of the parser that can be configured, I see some kind of SamlBinding in the SAMLProcessorImpl class. That seems to hold the decoder.
The first line of SAML message is:
<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="s29e0437f7f268017d5f6a5766797621c301feb737" Version="2.0" IssueInstant="2016-06-21T20:01:18Z" Destination="http://www.xxxxxxxxxxxxxxxxxxxxxxxxx.com:9080/site/saml/SSO"><saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">http://fmdev.ist.intralink.bns:80</saml:Issuer><samlp:Status xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
and the error is complaining that the character ">" in "2.0:assertion">http" should be an attribute, ">" or "/>" which is the case!!!
Caused by: org.xml.sax.SAXParseException; lineNumber: 1; columnNumber: 303; Element type "saml:Issuer" must be followed by either attribute specifications, ">" or "/>".
Full exception trace below:
org.springframework.security.authentication.AuthenticationServiceException: Error decoding incoming SAML message
at org.springframework.security.saml.SAMLProcessingFilter.attemptAuthentication(SAMLProcessingFilter.java:94)
at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:195)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:192)
at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:166)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:87)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
at org.springframework.security.saml.metadata.MetadataGeneratorFilter.doFilter(MetadataGeneratorFilter.java:87)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:192)
at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:160)
at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346)
at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:259)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:220)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:122)
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:504)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:170)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)
at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:950)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:421)
at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1074)
at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:611)
at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:314)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
at java.lang.Thread.run(Thread.java:745)
Caused by: org.opensaml.ws.message.decoder.MessageDecodingException: Encountered error parsing message into its DOM representation
at org.opensaml.ws.message.decoder.BaseMessageDecoder.unmarshallMessage(BaseMessageDecoder.java:209)
at org.opensaml.saml2.binding.decoding.HTTPPostDecoder.doDecode(HTTPPostDecoder.java:91)
at org.opensaml.ws.message.decoder.BaseMessageDecoder.decode(BaseMessageDecoder.java:79)
at org.opensaml.saml2.binding.decoding.BaseSAML2MessageDecoder.decode(BaseSAML2MessageDecoder.java:70)
at org.springframework.security.saml.processor.SAMLProcessorImpl.retrieveMessage(SAMLProcessorImpl.java:105)
at org.springframework.security.saml.processor.SAMLProcessorImpl.retrieveMessage(SAMLProcessorImpl.java:172)
at org.springframework.security.saml.SAMLProcessingFilter.attemptAuthentication(SAMLProcessingFilter.java:77)
... 30 more
Caused by: org.opensaml.xml.parse.XMLParserException: Invalid XML
at org.opensaml.xml.parse.StaticBasicParserPool.parse(StaticBasicParserPool.java:237)
at org.opensaml.ws.message.decoder.BaseMessageDecoder.unmarshallMessage(BaseMessageDecoder.java:186)
... 36 more
Caused by: org.xml.sax.SAXParseException; lineNumber: 1; columnNumber: 303; Element type "saml:Issuer" must be followed by either attribute specifications, ">" or "/>".
at org.apache.xerces.parsers.DOMParser.parse(Unknown Source)
at org.apache.xerces.jaxp.DocumentBuilderImpl.parse(Unknown Source)
at javax.xml.parsers.DocumentBuilder.parse(DocumentBuilder.java:121)
at org.opensaml.xml.parse.StaticBasicParserPool$DocumentBuilderProxy.parse(StaticBasicParserPool.java:673)
at org.opensaml.xml.parse.StaticBasicParserPool.parse(StaticBasicParserPool.java:234)

Answer 1

I investigated more into this. I noticed there is a difference in characters passed to the DOM parser between the working Java app and the Spring SAML one. Looking more into it, I found out that the message retrieved in the HTTPPostDecoder:getBase64DecodedMessage() is truncated. The encoded message I was using for testing had "+" signs and that needed to be encoded in the HTTP request. Should be replaced with "%2B". Doing this resolved the issue.

Answer 2

I am facing same issue while parsing/decoding SAML response. To resolve this issue I use encodeURIComponent()to convert/encode our SAML Response.
Details:
Tech Stack : **NodeJS**
Lib using for SAML code decode **saml2-js**
Code:
const postAssertGetSamlResponse = async(attr) => {
return new Promise((resolve, reject) => {
attr.SP.post_assert(attr.IDP,attr.options,function(err,decodedSamlResponse) {
if (err != null) {
console.log(err);
}
let data = {
decodedSAMLResponse: decodedSamlResponse,
redirectURL: attr.redirectClientURL
}
return resolve(data);
});
});
}
let regex = new RegExp("(([^&#]*)|&|#|$)");
let results = regex.exec(req.SAMLResponse);
results[2] = decodeURIComponent(results[2]);
results[2] = encodeURIComponent(results[2]);
let samlResponse = decodeURIComponent(results[2].replace(/\+/g, " "));
attrs = {
redirectClientURL: "https://test.com"
}
attrs.options = {
request_body: {
SAMLResponse: samlResponse
}
};
let data = await postAssertGetSamlResponse(attr);
console.log("SAML response ::", data);