3 Replies Latest reply on Jun 10, 2009 4:33 PM by anil.saldhana

Error message when trying to Marshal/Unmarshal SAML Response

pdog Jun 9, 2009 2:24 PM

We started receiving this error message today at 11:30am EST. We have not changed any of our code and it was able to marshal a SAML Response message before that time.

14:18:46,330 ERROR [IDPRedirectValve] Exception in send::
org.xml.sax.SAXParseException: src-resolve: Cannot resolve the name 'ds:Signature' to a(n) 'element declaration' component.
 at com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.createSAXParseException(ErrorHandlerWrapper.java:236)
 at com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.error(ErrorHandlerWrapper.java:172)
 at com.sun.org.apache.xerces.internal.impl.XMLErrorReporter.reportError(XMLErrorReporter.java:382)
 at com.sun.org.apache.xerces.internal.impl.xs.traversers.XSDHandler.reportSchemaError(XSDHandler.java:2241)
 at com.sun.org.apache.xerces.internal.impl.xs.traversers.XSDHandler.getGlobalDecl(XSDHandler.java:1201)
 at com.sun.org.apache.xerces.internal.impl.xs.traversers.XSDElementTraverser.traverseLocal(XSDElementTraverser.java:194)
 at com.sun.org.apache.xerces.internal.impl.xs.traversers.XSDHandler.traverseLocalElements(XSDHandler.java:1781)
 at com.sun.org.apache.xerces.internal.impl.xs.traversers.XSDHandler.parseSchema(XSDHandler.java:484)
 at com.sun.org.apache.xerces.internal.impl.xs.XMLSchemaLoader.loadSchema(XMLSchemaLoader.java:556)
 at com.sun.org.apache.xerces.internal.impl.xs.XMLSchemaLoader.loadGrammar(XMLSchemaLoader.java:523)
 at com.sun.org.apache.xerces.internal.jaxp.validation.xs.SchemaFactoryImpl.newSchema(SchemaFactoryImpl.java:206)
 at javax.xml.validation.SchemaFactory.newSchema(SchemaFactory.java:489)
 at javax.xml.validation.SchemaFactory.newSchema(SchemaFactory.java:521)
 at org.jboss.identity.federation.core.util.JAXBUtil.getValidatingMarshaller(JAXBUtil.java:64)
 at org.jboss.identity.federation.core.saml.v2.factories.JBossSAMLAuthnResponseFactory.getValidatingMarshaller(JBossSAMLAuthnResponseFactory.java:185)
 at org.jboss.identity.federation.api.saml.v2.response.SAML2Response.marshall(SAML2Response.java:269)
 at com.cc.saml.identityprovider.IDPRedirectValve.send(IDPRedirectValve.java:123)
 at com.cc.saml.identityprovider.IDPRedirectValve.invoke(IDPRedirectValve.java:85)
 at org.jboss.web.tomcat.security.JaccContextValve.invoke(JaccContextValve.java:84)
 at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
 at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
 at org.jboss.web.tomcat.service.jca.CachedConnectionValve.invoke(CachedConnectionValve.java:157)
 at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
 at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:262)
 at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:844)
 at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:583)
 at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:446)
 at java.lang.Thread.run(Thread.java:595)
14:18:46,330 ERROR [IDPRedirectValve] Exception:
javax.servlet.ServletException: src-resolve: Cannot resolve the name 'ds:Signature' to a(n) 'element declaration' component.
 at com.cc.saml.identityprovider.IDPRedirectValve.send(IDPRedirectValve.java:139)
 at com.cc.saml.identityprovider.IDPRedirectValve.invoke(IDPRedirectValve.java:85)
 at org.jboss.web.tomcat.security.JaccContextValve.invoke(JaccContextValve.java:84)
 at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
 at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
 at org.jboss.web.tomcat.service.jca.CachedConnectionValve.invoke(CachedConnectionValve.java:157)
 at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
 at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:262)
 at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:844)
 at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:583)
 at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:446)
 at java.lang.Thread.run(Thread.java:595)
14:18:47,845 ERROR [IDPRedirectValve] Exception in send::
org.xml.sax.SAXParseException: src-resolve: Cannot resolve the name 'ds:Signature' to a(n) 'element declaration' component.
 at com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.createSAXParseException(ErrorHandlerWrapper.java:236)
 at com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.error(ErrorHandlerWrapper.java:172)
 at com.sun.org.apache.xerces.internal.impl.XMLErrorReporter.reportError(XMLErrorReporter.java:382)
 at com.sun.org.apache.xerces.internal.impl.xs.traversers.XSDHandler.reportSchemaError(XSDHandler.java:2241)
 at com.sun.org.apache.xerces.internal.impl.xs.traversers.XSDHandler.getGlobalDecl(XSDHandler.java:1201)
 at com.sun.org.apache.xerces.internal.impl.xs.traversers.XSDElementTraverser.traverseLocal(XSDElementTraverser.java:194)
 at com.sun.org.apache.xerces.internal.impl.xs.traversers.XSDHandler.traverseLocalElements(XSDHandler.java:1781)
 at com.sun.org.apache.xerces.internal.impl.xs.traversers.XSDHandler.parseSchema(XSDHandler.java:484)
 at com.sun.org.apache.xerces.internal.impl.xs.XMLSchemaLoader.loadSchema(XMLSchemaLoader.java:556)
 at com.sun.org.apache.xerces.internal.impl.xs.XMLSchemaLoader.loadGrammar(XMLSchemaLoader.java:523)
 at com.sun.org.apache.xerces.internal.jaxp.validation.xs.SchemaFactoryImpl.newSchema(SchemaFactoryImpl.java:206)
 at javax.xml.validation.SchemaFactory.newSchema(SchemaFactory.java:489)
 at javax.xml.validation.SchemaFactory.newSchema(SchemaFactory.java:521)
 at org.jboss.identity.federation.core.util.JAXBUtil.getValidatingMarshaller(JAXBUtil.java:64)
 at org.jboss.identity.federation.core.saml.v2.factories.JBossSAMLAuthnResponseFactory.getValidatingMarshaller(JBossSAMLAuthnResponseFactory.java:185)
 at org.jboss.identity.federation.api.saml.v2.response.SAML2Response.marshall(SAML2Response.java:269)
 at com.cc.saml.identityprovider.IDPRedirectValve.send(IDPRedirectValve.java:123)
 at com.cc.saml.identityprovider.IDPRedirectValve.invoke(IDPRedirectValve.java:91)
 at org.jboss.web.tomcat.security.JaccContextValve.invoke(JaccContextValve.java:84)
 at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
 at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
 at org.jboss.web.tomcat.service.jca.CachedConnectionValve.invoke(CachedConnectionValve.java:157)
 at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
 at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:262)
 at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:844)
 at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:583)
 at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:446)
 at java.lang.Thread.run(Thread.java:595)
14:18:47,845 ERROR [CoyoteAdapter] An exception or error occurred in the container during the request processing
javax.servlet.ServletException: src-resolve: Cannot resolve the name 'ds:Signature' to a(n) 'element declaration' component.
 at com.cc.saml.identityprovider.IDPRedirectValve.send(IDPRedirectValve.java:139)
 at com.cc.saml.identityprovider.IDPRedirectValve.invoke(IDPRedirectValve.java:91)
 at org.jboss.web.tomcat.security.JaccContextValve.invoke(JaccContextValve.java:84)
 at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
 at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
 at org.jboss.web.tomcat.service.jca.CachedConnectionValve.invoke(CachedConnectionValve.java:157)
 at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
 at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:262)
 at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:844)
 at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:583)
 at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:446)
 at java.lang.Thread.run(Thread.java:595)

From the looks of it the xsd has changed on the w3.org site but they are being referenced in the identity jars.

Has anyone else started experiencing any errors like this today? Any suggestions?

1. Re: Error message when trying to Marshal/Unmarshal SAML Resp

pdog Jun 10, 2009 11:02 AM (in response to pdog)

I started decompiling the SAML2Response class to try and figure out the problem. Was happening when it was trying validate the schema in JBossSAMLBaseFactory.getValidatingMarshaller.

The schema that is referenced, schema/saml/v2/saml-schema-protocol-2.0.xsd, does point to a schema on w3.org but the location wasn't down. I got around this by overriding that method so that it doesn't try and validate the schema but the problem still exists at least for me in my environment. Could be an environment issue.
Actions
2. Re: Error message when trying to Marshal/Unmarshal SAML Resp

anil.saldhana Jun 10, 2009 4:10 PM (in response to pdog)
Actually, we were also very surprised by this sudden schema parsing issues starting Tue. We have not figured it out (probably will never).

One thing you need to ensure is that you will need to endorse the xerces libraries. Somehow the xerces implementation packaged in the Sun JDK has some bugs that have been fixed in Apache Xerces. So try getting all the jars from http://anonsvn.jboss.org/repos/jbossidentity/identity-federation/tags/1.0.0.alpha3/jboss-identity-fed-api/src/test/resources/endorsed/
and use a system property
-Djava.endorsed.dirs=mydir

where mydir is the directory where the endorsed libraries are present.
Actions
3. Re: Error message when trying to Marshal/Unmarshal SAML Resp

anil.saldhana Jun 10, 2009 4:33 PM (in response to pdog)

Pete, can you tell us further what use cases you are solving with JBoss Identity? We just want to know.

Thanks for the feedback.
* We love to hear what works.
* What does not work and
* how we can improve
Actions

Go to original post