ADFS Problem

[Abudi7]

We get an error, when using adfs server as IDP
Error details: Found invalid data while decoding.

What do we have to configure to get adfs server working?
Thanks for your helping.

[a-menshchikov]

Hi @Abudi7
Could you show your configuration of the onelogin-saml-bundle + the stack trace of that error?

[Abudi7]

Hi @a-menshchikov , it is the Basic configuration like in the documentation on Github.

nbgrp_onelogin_saml:
onelogin_settings:
default:
# Mandatory SAML settings
idp:
entityId: 'http://adfs.my-domain.com/adfs/services/trust'
singleSignOnService:
url: 'https://adfs.my-domain.com/adfs/ls/'
binding: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect'
singleLogoutService:
url: 'https://adfs.my-domain.com/adfs/ls/'
binding: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect'
x509cert: 'MIIC4jCCAcqgAfgfgfDAtMSswKQYDVQQDEyJBREZTIFNpZ25pbmcgLSBhZGZzLmFudG9uLXBhYXIuY29tMB4XDTIxMDQwODExNUyBTaWduaW5nIC0gYWRmcy5hbnRvbi1wYWFyLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAM+yta9/VQ4z/pLhP+nEBgKRyIjHultvhmAvXC5xQGWJ91g30ZbB05ObhHhxhDhidWMRUzKp3uaFy5itdYN/PMWNWKmK3PatfzkNddHEB6Vdafhd+dvf9HU2RksdG0kms/FCglR8ApeHwXJd/frVaMwejY9v1GSIEY3TLhWMKSmlrXtDMfvvFRJNegeLyHrGyQMaLb80RF7PlcpQ50J/pEmrKCUNqEwDkn4VEhWMtAJ+aX29nrfTG6vCkyE+on8ox4zq6fStyz1x6Jdo/fckMEBG64NkzopJDmy2/dE3R2j/eQuEVH1CxtavN5YDTD6bAvD20J4NmYE3bohaBYoZYdECAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAY6i4E7CFfTA22cwql39w7sVasIUmrNCE2ydTdcUk+EbjFOylxplIXrqChpCrQJQe9mvOZN7p8xqis6J15hedp25RD5wurF4LPo+O2TDDDvYsRqPXFBSCgiGRJuvntJFisfpbM/LmPE4jHrF/1TpUo4jTR6Gg8q9SozNpHttti6uEl1hQX97zT2vbxaP9BNhB6dIAOOV9OGV3itY+sj8BHUyqUbxmaougaWaaN82tXek+5CDVLYc/g7xo2ahAWSengrX/KX3l5cIbLkLdJAzp3KxdaCtXpAttUIA3lieITTeT3ADhUp7x3zEAXivneurlVwxzIxEpmaO/rhIm2UeXBw=='
sp:
entityId: 'https://imp-dev.my-domain.com/saml/metadata' # Default: '<request_scheme_and_host>/saml/metadata'
assertionConsumerService:
url: 'https://imp-dev.my-domain.com/saml/acs' # Default: '<request_scheme_and_host>/saml/acs'
binding: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST'
singleLogoutService:
url: 'https://imp-dev.my-domain.com/saml/logout' # Default: '<request_scheme_and_host>/saml/logout'
binding: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect'
privateKey: 'MIIEvQIBAgdfgdfgU7A1Mds8DMmP7pBtH85F7CjD79WSNYTmkOWay4UQKBgEwK49te+NddST5Gpfso52eADTm5SCZcOgYdU8/8IS5JZoOtlV6axQWXV/e2rSrmq1YsFxRT32eidjBi8gUcM4LoUPYzJYWmKku9uidVShesD/K2a9PpFRzuf8CKr28q7uN+Dc3JE9dwWgmGGKXmcvGJbXi0qqZlibS29y5LzJyRAoGBAKleHMOip84ZmDy90Mk7bo6adO9VzeUHs+T3gxukHsLbicSEzc0JeAg9QmxHi+75IC5XVNayI5jKkwTnKFb0dZaIi26B0PJZiBIDgdLk1/+xiAUNp/sA7ZRruFiCCkAtoJZrQU7+PXlDrDOa5OLn55qtT6Ty1Si0XX5QtTLgtSexAoGAWVy7L9IXUT84oKn3V2QqpLuNjAzDkIG8fLO1ZL3H0l/rEeDaJ3IIV6xIPbvR9FUygR9RDfhbJbMMRvwjxtiPGn6yK2HVz1pM/1+A4IL8UF7cLdwqReohigBWDv7f3S+g+DbK4rAmyGr+DTHQPr3kSX4dkwfTynMOQc7yPMgxJn8='
x509cert: 'MIIDfTCCAmWgAwIdhfgdhfghghkzklhWExDTALBgNVBAcMBEdyYXoxGDAWBgNVBAoMD0FudG9uIFBhYXIgR21iSDELMAkGA1UECwwCSVQwIBcNMTcwNDEyMTAzODI0WhgPMjExNzA0MDgxMDM4MjRaMFQxCzAJBgNVBAYTAkFUMQ8wDQYDVQQIDAZTdHlyaWExDTALBgNVBAcMBEdyYXoxGDAWBgNVBAoMD0FudG9uIFBhYXIgR21iSDELMAkGA1UECwwCSVQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCrSNauwWBZCrticFgWojWqqHWJxerJhfGoy+8tABX/VCZwRlBOTYL3njcksT3MAxS4Q0ck4iLfJrKtIxgwROnS1F5n3PevI0S2t3aGXl1yE7RTJeTWPcEVYyPFPSoQhHt2LexAiTk0t0ukGbyBZN3+9saBKd+Zt2BpkPYNbiDG2DtyUUkPrBggIv9bEtKZSW7Hzppj6vg2+3Kom8k4odax1LwBGeOoLU/2EECVDyIEotuuh2GZ0sdqEsLAEvE6VgkMAovEWFQ+4jFshSyaClms8+Ec6c/4xtnDP03q6+HT26ANbsYr+I07nuTlXGDeQ3S8kJsgGgvV4YD9q8+iqz2FAgMBAAGjUDBOMB0GA1UdDgQWBBRlex099FcJGz3caERiEDSDYlR+ZzAfBgNVHSMEGDAWgBRlex099FcJGz3caERiEDSDYlR+ZzAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4IBAQBKd48LFGMecCelPmbNeIraFuchOd2HpRl1XDOffit1ZCtZrm5LjpISv8+zzDQFLY4e4KWumcuDxb9NU6DiquT7pP1aQmMJd2H6tbKoul8p3mi50hHiAKs6zy8tV4eDgWq6n3r5VQK9SpdVjeZOikE6sq4FtrhNgQRaZ3TGYrT52fkVHJym3EzeAcZkoG1RnW0JtVVstMajFEVW+poHrPe2PDo9Rn9Nq/U2M4uMHXtw86jjjX9YDqGBjF/ZIbge0rrt0ixQzuAu/p60IdTxRBnsFJaPaQr1XaKfKSEMbR21LKEvuXXFwydqA9gFjtsm2x/OuKGTkoYL1UGJXZmFyEtR'
# Optional SAML settings
baseurl: 'https://imp-dev.my-domain.com/saml/' # Default: '<request_scheme_and_host>/saml/'
strict: true
debug: true
security:
nameIdEncrypted: false
authnRequestsSigned: true
logoutRequestSigned: false
logoutResponseSigned: false
signMetadata: false
wantMessagesSigned: false
wantAssertionsEncrypted: false
wantAssertionsSigned: false
wantNameId: false
wantNameIdEncrypted: false
requestedAuthnContext: true
wantXMLValidation: false
relaxDestinationValidation: true
destinationStrictlyMatches: true
allowRepeatAttributeName: false
rejectUnsolicitedResponsesWithInResponseTo: false
signatureAlgorithm: 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256'
digestAlgorithm: 'http://www.w3.org/2001/04/xmlenc#sha256'
encryption_algorithm: 'http://www.w3.org/2001/04/xmlenc#aes256-cbc'
lowercaseUrlencoding: false
compress:
requests: false
responses: false
# Optional another one SAML settings (see Multiple IdP below)
#another:
# idp:
# ...
# sp:
# ...
# ...
# Optional parameters
#use_proxy_vars: true
idp_parameter_name: 'custom-idp'
entity_manager_name: 'custom-em'

The request never comes back to Symfony. with simplesaml every thing work fine.

This is the error message on the adfs side:

Activity ID: 8d25e23f-234e-4b48-d84d-0040010000b4

Error details: Found invalid data while decoding.
Node name: 50a94d7d-4149-468e-90c0-e573941a2cc2
Error time: Tue, 07 Nov 2023 10:45:35 GMT
Cookie: enabled
User agent string: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36

[VanillaBerry]

We get an error, when using adfs server as IDP Error details: Found invalid data while decoding.

What do we have to configure to get adfs server working? Thanks for your helping.

This helped me.
<..>
compress:
requests: true
responses: false
<..>

[a-menshchikov]

@Abudi7 is this issue still actual for you?