After some investigation I could find the issue in the code and created an issue [1] on github, which was already resolved.
Best -- Robert [1] https://github.com/apereo/cas/issues/2460 On Thursday, March 16, 2017 at 9:23:49 AM UTC+1, Robert Ledermüller wrote: > > Maybe I've found the issue but have to investigate more. > > This part seems strange and was different in CAS 5.0.3.1. > > <saml2:Attribute FriendlyName="uid" Name="uid"> > <saml1:AttributeValue > xmlns:saml1="urn:oasis:names:tc:SAML:1.0:assertion" > > xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"; xsi:type="xsd:string"> > user@email > </saml1:AttributeValue> > </saml2:Attribute> > > > > > I guess the <saml1:AttributeValue> should be <saml2:AttributeValue>. > > > Even our older version of Shibboleth responded like this: > > > <saml2:Attribute Name="uid" > NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"> > <saml2:AttributeValue > xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"; > xsi:type="xs:string">user@email</saml2:AttributeValue> > </saml2:Attribute> > > > So I have to find out why CAS 5.1.0-RC2 is returning saml1 attribute values > within a saml2 attribute tag. > > > > On Wednesday, March 15, 2017 at 5:06:00 PM UTC+1, Robert Ledermüller wrote: >> >> Hi, >> >> we are trying to replace our Shibboleth with CAS SAML2 IdP functionality. >> In our setup CAS is the IdP and ADFS 2.0 is the relying party. >> >> Initiating the request seems to work even the response seems to be >> accepted from ADFS in the first place but the XML is not valid?! >> >> >> The Federation Service encountered an error while processing the WS-Trust >> request. >> Request type: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue >> >> >> Additional Data >> Exception details: >> System.Xml.XmlException: 'Element' is an invalid XmlNodeType. >> at System.Xml.XmlReader.ReadEndElement() >> at Microsoft.IdentityModel.Tokens.Saml2.Saml2SecurityTokenHandler. >> ReadAttribute(XmlReader reader) >> at Microsoft.IdentityModel.Tokens.Saml2.Saml2SecurityTokenHandler. >> ReadAttributeStatement(XmlReader reader) >> at Microsoft.IdentityModel.Tokens.Saml2.Saml2SecurityTokenHandler. >> ReadAssertion(XmlReader reader) >> at Microsoft.IdentityModel.Tokens.Saml2.Saml2SecurityTokenHandler. >> ReadToken(XmlReader reader) >> at Microsoft.IdentityModel.Tokens.SecurityTokenHandlerCollection. >> ReadToken(XmlReader reader) >> at Microsoft.IdentityModel.Tokens.SecurityTokenElement. >> ReadSecurityToken(XmlElement securityTokenXml, >> SecurityTokenHandlerCollection securityTokenHandlers) >> at Microsoft.IdentityModel.Tokens.SecurityTokenElement. >> GetSecurityToken() >> at Microsoft.IdentityServer.Service.Tokens. >> SamlMessageSecurityTokenHandler.ReadToken(XmlReader reader) >> at Microsoft.IdentityModel.Tokens.SecurityTokenHandlerCollection. >> ReadToken(XmlReader reader) >> at Microsoft.IdentityModel.Tokens.SecurityTokenElement. >> ReadSecurityToken(XmlElement securityTokenXml, >> SecurityTokenHandlerCollection securityTokenHandlers) >> at Microsoft.IdentityModel.Tokens.SecurityTokenElement. >> GetSecurityToken() >> at Microsoft.IdentityServer.Service.SecurityTokenService. >> MSISSecurityTokenService.GetOnBehalfOfPrincipal(RequestSecurityToken >> request, IClaimsPrincipal callerPrincipal) >> at Microsoft.IdentityServer.Service.SecurityTokenService. >> MSISSecurityTokenService.BeginGetScope(IClaimsPrincipal principal, >> RequestSecurityToken request, AsyncCallback callback, Object state) >> at Microsoft.IdentityModel.SecurityTokenService.SecurityTokenService. >> BeginIssue(IClaimsPrincipal principal, RequestSecurityToken request, >> AsyncCallback callback, Object state) >> at Microsoft.IdentityModel.Protocols.WSTrust.WSTrustServiceContract. >> DispatchRequestAsyncResult..ctor(DispatchContext dispatchContext, >> AsyncCallback asyncCallback, Object asyncState) >> at Microsoft.IdentityModel.Protocols.WSTrust.WSTrustServiceContract. >> BeginDispatchRequest(DispatchContext dispatchContext, AsyncCallback >> asyncCallback, Object asyncState) >> at Microsoft.IdentityModel.Protocols.WSTrust.WSTrustServiceContract. >> ProcessCoreAsyncResult..ctor(WSTrustServiceContract contract, >> DispatchContext dispatchContext, MessageVersion messageVersion, >> WSTrustResponseSerializer responseSerializer, WSTrustSerializationContext >> serializationContext, AsyncCallback asyncCallback, Object asyncState) >> at Microsoft.IdentityModel.Protocols.WSTrust.WSTrustServiceContract. >> BeginProcessCore(Message requestMessage, WSTrustRequestSerializer >> requestSerializer, WSTrustResponseSerializer responseSerializer, String >> requestAction, String responseAction, String trustNamespace, >> AsyncCallback callback, Object state) >> >> >> The following response is sent to ADFS: >> >> <?xml version="1.0" encoding="UTF-8"?> >> <saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" >> Consent="urn:oasis:names:tc:SAML:2.0:consent:unspecified" >> ID="_5712367945321305809" >> InResponseTo="id-2f792815-f7e3-4c8a-9330-6b28163dbcc0" >> IssueInstant="2017-03-15T15:06:09.915Z" >> Version="2.0"> >> <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" >> >> Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">https://..../idp >> </saml2:Issuer> >> <saml2p:Status> >> <saml2p:StatusCode >> Value="urn:oasis:names:tc:SAML:2.0:status:Success"/> >> >> <saml2p:StatusMessage>urn:oasis:names:tc:SAML:2.0:status:Success</saml2p:StatusMessage> >> </saml2p:Status> >> <saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" >> xmlns:xsd="http://www.w3.org/2001/XMLSchema"; >> ID="_3048198097917129868" >> IssueInstant="2017-03-15T15:06:09.896Z" Version="2.0"> >> <saml2:Issuer>https://..../idp</saml2:Issuer> >> <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#";> >> <ds:SignedInfo> >> <ds:CanonicalizationMethod >> Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/> >> <ds:SignatureMethod >> Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/> >> <ds:Reference URI="#_3048198097917129868"> >> <ds:Transforms> >> <ds:Transform >> Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/> >> <ds:Transform >> Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#";> >> <ec:InclusiveNamespaces >> xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"; >> PrefixList="xsd"/> >> </ds:Transform> >> </ds:Transforms> >> <ds:DigestMethod >> Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/> >> >> <ds:DigestValue>GQbmCPA99DH9lIfdnySXDqxYQfLuJGpnsco0t8lnEuA=</ds:DigestValue> >> </ds:Reference> >> </ds:SignedInfo> >> <ds:SignatureValue> >> >> CLgTqUpNHI+ThCIaQ+iI4++puLuCijAyjXGQnOgYE5zWjQlP0PBFmvbaTlDpaOd36I1E+NEP2cjB >> >> 22EbIf0XmL7Z6hqdtQE6wIa754SMVReG9jWG2MvrhVX/aU512Tzz4/6KAQ5IrpRMJ7sfC+y6ZbD6 >> >> PudR6QgLADL7daG4jnX7BykJ7FzoY1D2ktCKTgmaLnxwvBxW5leVH1adaRQHytdW1bFqRuAq7mPF >> >> kEyTEJ6MG+E1rXiKHY3dDJdYl3F2CBr+82xjMtt7E/HF0UaW0VbfnS/fcFf6oBUoQ0Ogcoc0hPOL >> EtP8FCraP2g4byjaPKpWscIJ5iZ3VMKjN8vrlQ== >> </ds:SignatureValue> >> <ds:KeyInfo> >> <ds:X509Data> >> >> <ds:X509Certificate>MIIDODCCAiCgAwIBAgIUacPILYM92afNNZNJgvi8C6VqxG0wDQYJKoZIhvcNAQELBQAwITEfMB0G >> >> A1UEAwwWZXh0cmFuZXQtcWFzLmJyb3NlLmNvbTAeFw0xNzAyMjQyMDE0MzVaFw0zNzAyMjQyMDE0 >> >> MzVaMCExHzAdBgNVBAMMFmV4dHJhbmV0LXFhcy5icm9zZS5jb20wggEiMA0GCSqGSIb3DQEBAQUA >> >> A4IBDwAwggEKAoIBAQCn8f4LB3U5/ZGLJnZP8bm2zCVg0SL0aeBAfNeiC59ChEKGHw93D+9Bwl7I >> >> AjffDcuRGK+SjKVX6m55A/3sCFp4GnsKNzdzxgDxStbADC4/fC4TYSaUG83qzpjLc776/Z9s/IDz >> >> SUZ7mTvcH3eusWctI+cRLRrGO/7qfg0Z6Blxppmtc0+/ZrfaPQ9Gtzt94GSY7KCNYecGcbvZXrkQ >> >> BpKYzoiu0ViECz6xNnRYKf1U3TCrZnwdkQe3v4HSr8xEMbMv0JOneSRQsfdzrPguwOxDkEU/pIEM >> >> Dqwy/MjZxAr5885GHgwqcD4X+vk2nscGasH4+R+HqLmeTvBRawW5eES5AgMBAAGjaDBmMB0GA1Ud >> >> DgQWBBT6DDaEyWBg/e5luv8yB5aJUZT9DjBFBgNVHREEPjA8ghZleHRyYW5ldC1xYXMuYnJvc2Uu >> >> Y29thiJleHRyYW5ldC1xYXMuYnJvc2UuY29taWRwL21ldGFkYXRhMA0GCSqGSIb3DQEBCwUAA4IB >> >> AQAFoqrOBTyGch0ga6kw//H01e6OWW4dYTEswsgg2Bc5EJKju5KDufcX0TiU3OaMGE6ebeLWjMYV >> >> JI8wbrWw4F0+sL0mV4fAmdSyvljDI1gTW6ZFbMmmKqYEqm6nfpncoX10TtuF4AEEEK8jsEHF9J74 >> >> hfnFwyws6y5Ph0ANGH7pobvJt5O+b3+fgOLrj1LcwEZui4rdbyYR29QlL0aXrol4MbJqwQHe8/1E >> >> sDthVUjX4Sz/BCxjJxAVRpQ862fGgLHTWFlI9maxkeNb+H9fJwgl6Yizslyczo0ZadezLlomvO90 >> Tg0M0CF9x7KkWA4wv+uW/K548ydHA4MH+sqj9skH >> </ds:X509Certificate> >> </ds:X509Data> >> </ds:KeyInfo> >> </ds:Signature> >> <saml2:Subject> >> <saml2:NameID >> Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">user@email >> </saml2:NameID> >> <saml2:SubjectConfirmation >> Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"> >> <saml2:SubjectConfirmationData >> InResponseTo="id-2f792815-f7e3-4c8a-9330-6b28163dbcc0" >> >> NotOnOrAfter="2017-03-15T15:07:09.885Z"/> >> </saml2:SubjectConfirmation> >> </saml2:Subject> >> <saml2:Conditions NotBefore="2017-03-15T15:06:09.899Z" >> NotOnOrAfter="2017-03-15T15:07:09.899Z"> >> <saml2:AudienceRestriction> >> >> <saml2:Audience>https://..../adfs/services/trust</saml2:Audience> >> </saml2:AudienceRestriction> >> </saml2:Conditions> >> <saml2:AuthnStatement AuthnInstant="2017-03-15T15:06:09.885Z"> >> <saml2:SubjectLocality >> Address="https://..../adfs/services/trust"/> >> <saml2:AuthnContext> >> >> <saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified >> </saml2:AuthnContextClassRef> >> </saml2:AuthnContext> >> </saml2:AuthnStatement> >> <saml2:AttributeStatement> >> <saml2:Attribute >> FriendlyName="samlAuthenticationStatementAuthMethod" >> Name="samlAuthenticationStatementAuthMethod"> >> <saml1:AttributeValue >> xmlns:saml1="urn:oasis:names:tc:SAML:1.0:assertion" >> >> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"; xsi:type="xsd:string"> >> urn:oasis:names:tc:SAML:1.0:am:password >> </saml1:AttributeValue> >> </saml2:Attribute> >> <saml2:Attribute FriendlyName="uid" Name="uid"> >> <saml1:AttributeValue >> xmlns:saml1="urn:oasis:names:tc:SAML:1.0:assertion" >> >> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"; xsi:type="xsd:string"> >> user@email >> </saml1:AttributeValue> >> </saml2:Attribute> >> <saml2:Attribute FriendlyName="isFromNewLogin" >> Name="isFromNewLogin"> >> <saml1:AttributeValue >> xmlns:saml1="urn:oasis:names:tc:SAML:1.0:assertion" >> >> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"; >> xsi:type="xsd:string">false >> </saml1:AttributeValue> >> </saml2:Attribute> >> <saml2:Attribute FriendlyName="authenticationDate" >> Name="authenticationDate"> >> <saml1:AttributeValue >> xmlns:saml1="urn:oasis:names:tc:SAML:1.0:assertion" >> >> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"; xsi:type="xsd:string"> >> 2017-03-15T16:06:09.734+01:00[Europe/Berlin] >> </saml1:AttributeValue> >> </saml2:Attribute> >> <saml2:Attribute FriendlyName="authenticationMethod" >> Name="authenticationMethod"> >> <saml1:AttributeValue >> xmlns:saml1="urn:oasis:names:tc:SAML:1.0:assertion" >> >> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"; xsi:type="xsd:string"> >> specialAuthenticator >> </saml1:AttributeValue> >> </saml2:Attribute> >> <saml2:Attribute FriendlyName="successfulAuthenticationHandlers" >> Name="successfulAuthenticationHandlers"> >> <saml1:AttributeValue >> xmlns:saml1="urn:oasis:names:tc:SAML:1.0:assertion" >> >> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"; xsi:type="xsd:string"> >> specialAuthenticator >> </saml1:AttributeValue> >> </saml2:Attribute> >> <saml2:Attribute >> FriendlyName="longTermAuthenticationRequestTokenUsed" >> Name="longTermAuthenticationRequestTokenUsed"> >> <saml1:AttributeValue >> xmlns:saml1="urn:oasis:names:tc:SAML:1.0:assertion" >> >> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"; >> xsi:type="xsd:string">false >> </saml1:AttributeValue> >> </saml2:Attribute> >> </saml2:AttributeStatement> >> </saml2:Assertion> >> </saml2p:Response> >> >> >> Any help or hints are appreciated. Even debug logging on ADFS provides me >> any useful info. >> >> >> Best >> >> -- Robert >> >> -- - CAS gitter chatroom: https://gitter.im/apereo/cas - CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html - CAS documentation website: https://apereo.github.io/cas - CAS project website: https://github.com/apereo/cas --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/745c9ddd-28d7-48fb-8dd9-db10d59eb745%40apereo.org.
