SAML2 - Error PL00062 Unknown tag #13092

sebdew · 2022-07-13T15:35:15Z

sebdew
Jul 13, 2022

Hello, I request your help because I'm having an issue by enabling SAML SSO with LemonLDAP::NG and Keycloak. LemonLDAP::NG is my SP and Keycloak my IDP.

I configured everything like I have done with other applications. But, when I try to login to LemonLDAP::NG, Keycloak show me an Invalid Request error. In the Keycloak log, I have the following error :

14:27:46,412 ERROR [org.keycloak.saml.common] (default task-2) Error in base64 decoding saml message: java.lang.RuntimeException: PL00062: Parser : Unknown tag:Count::location=Line number = 39
Column number = 241
System Id = null
Public Id = null
Location Uri= null
CharacterOffset = 2646

My LemonLDAP::NG SAML Auth XML request contain a namespace called "Count" and this namespace is unknown for Keycloak.

I found nothing on internet on how to solve that issue. It seems this thread discuss about the same problem but without any answer. https://groups.google.com/g/keycloak-user/c/bjTSmpYxwzg

So my question is simple, is there a way to setup keycloak SAML support such that it ignores optional namespace definitions or to be less "strict" ?

Thanks in advance for your help !

Sébastien.

PS : this is the XML sent to Keycloack. You will found the namespace that cause trouble at the end of the XML.

<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="_B2ADA253EC3B0026E23FB32B56FDA8FD" Version="2.0" IssueInstant="2022-07-13T14:27:02Z" Destination="https://auth.xxx.fr/auth/realms/xxx/protocol/saml" ForceAuthn="false" IsPassive="false">
 <saml:Issuer>https://portal.xxx.fr/saml/metadata</saml:Issuer>
 <Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
  <SignedInfo>
   <CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"></CanonicalizationMethod>
   <SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"></SignatureMethod>
   <Reference URI="#_B2ADA253EC3B0026E23FB32B56FDA8FD">
    <Transforms>
     <Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"></Transform>
     <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"></Transform>
    </Transforms>
    <DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"></DigestMethod>
    <DigestValue>xWVDGc/n3dAHItCff81GNW5O9QZPNhzhHQ0wuIgHcrk=</DigestValue>
   </Reference>
  </SignedInfo>
  <SignatureValue>xxx</SignatureValue>
  <KeyInfo>
   <X509Data>
    <X509Certificate>xxx</X509Certificate>
   </X509Data>
  </KeyInfo>
 </Signature>
 <samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" AllowCreate="true"></samlp:NameIDPolicy>
 <saml:Conditions>
  <saml:ProxyRestriction>
   <saml:Audience>https://auth.xxx.fr/auth/realms/xxx</saml:Audience>
   <saml:Count>0</saml:Count>
  </saml:ProxyRestriction>
 </saml:Conditions>
</samlp:AuthnRequest>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

SAML2 - Error PL00062 Unknown tag #13092

Uh oh!

{{title}}

Uh oh!

Replies: 0 comments

Select a reply

Uh oh!

SAML2 - Error PL00062 Unknown tag #13092

Uh oh!

sebdew Jul 13, 2022

Replies: 0 comments

sebdew
Jul 13, 2022