Okta PySAML2示例应用程序：IP启动的工作但SP启动失败

Question

我按照Okta的Setting up a SAML Application in Okta文档，包括this question中讨论的FirstName和LastName属性的调整，并按照Okta“PySAML2”页面（第三个链接的声誉不够）来运行使用Okta进行身份验证的Flask应用程序。

当运行Flask应用程序时（对'example-okta-com'URL进行适当的设置更改），IdP启动的流程正常工作，因此我可以从Okta获取示例应用程序，但如果我尝试单击应用程序中的'example-okta-com'链接指向http://localhost:5000/saml/login/example-okta-com，然后我被重定向到oktapreview.com子域的错误页面，我的测试应用程序包含以下堆栈跟踪：

Error: user_exception

Error parsing XML in SAML request
 com.saasure.application.factory.AppUserException: Error parsing XML in SAML request
    at com.saasure.application.generic.services.impl.OutboundSAMLServiceImpl.isForceAuthn(OutboundSAMLServiceImpl.java:351)
    at com.saasure.application.generic.ui.controller.sso.SAMLForceAuthnController.requiresForceAuthn(SAMLForceAuthnController.java:137)
    at com.saasure.application.generic.ui.controller.sso.DefaultSAMLController.handleSAML20AuthnRequestForSpecificInstance(DefaultSAMLController.java:97)
    at com.saasure.application.generic.ui.controller.sso.DefaultSAMLController.handleSAML20AuthnRequestForSpecificInstance(DefaultSAMLController.java:91)
    at sun.reflect.GeneratedMethodAccessor1246.invoke(Unknown Source)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:606)
    at org.springframework.web.method.support.InvocableHandlerMethod.invoke(InvocableHandlerMethod.java:215)
    at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:132)
    at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:104)
    at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandleMethod(RequestMappingHandlerAdapter.java:745)
    at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:685)
    at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:80)
    at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:919)
    at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:851)
    at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:953)
    at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:844)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:617)
    at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:829)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
    at com.saasure.framework.web.filter.ServletExceptionFilter.doFilterInternal(ServletExceptionFilter.java:30)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:106)
    at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:343)
    at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:260)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
    at com.saasure.framework.web.filter.GzipFilter.doFilterInternal(GzipFilter.java:26)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:106)
    at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:343)
    at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:260)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
    at com.saasure.framework.web.filter.HeadToGetFilter.doFilterInternal(HeadToGetFilter.java:31)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:106)
    at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:343)
    at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:260)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219)
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
    at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:470)
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
    at nl.remcojansen.tomcatlogging.JuliAccessLogValve.invoke(JuliAccessLogValve.java:355)
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:293)
    at org.apache.coyote.http11.Http11NioProcessor.process(Http11NioProcessor.java:889)
    at org.apache.coyote.http11.Http11NioProtocol$Http11ConnectionHandler.process(Http11NioProtocol.java:744)
    at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:2274)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
    at java.lang.Thread.run(Thread.java:745)
Caused by: org.opensaml.xml.parse.XMLParserException: Invalid XML
    at org.opensaml.xml.parse.BasicParserPool.parse(BasicParserPool.java:218)
    at com.saasure.framework.security.saml.impl.BaseSAMLBuilder.unmarshallXml(BaseSAMLBuilder.java:269)
    at com.saasure.framework.security.saml.impl.BaseSAMLBuilder.unmarshallXml(BaseSAMLBuilder.java:277)
    at com.saasure.framework.security.saml.impl.SAML20IdentityProviderImpl.unmarshallRequest(SAML20IdentityProviderImpl.java:337)
    at com.saasure.framework.security.saml.impl.SAML20IdentityProviderImpl.isForceAuthn(SAML20IdentityProviderImpl.java:320)
    at com.saasure.application.generic.services.impl.OutboundSAMLServiceImpl.isForceAuthn(OutboundSAMLServiceImpl.java:347)
    ... 53 more
Caused by: org.xml.sax.SAXParseException: Content is not allowed in prolog.
    at org.apache.xerces.util.ErrorHandlerWrapper.createSAXParseException(Unknown Source)
    at org.apache.xerces.util.ErrorHandlerWrapper.fatalError(Unknown Source)
    at org.apache.xerces.impl.XMLErrorReporter.reportError(Unknown Source)
    at org.apache.xerces.impl.XMLErrorReporter.reportError(Unknown Source)
    at org.apache.xerces.impl.XMLErrorReporter.reportError(Unknown Source)
    at org.apache.xerces.impl.XMLScanner.reportFatalError(Unknown Source)
    at org.apache.xerces.impl.XMLDocumentScannerImpl$PrologDispatcher.dispatch(Unknown Source)
    at org.apache.xerces.impl.XMLDocumentFragmentScannerImpl.scanDocument(Unknown Source)
    at org.apache.xerces.parsers.XML11Configuration.parse(Unknown Source)
    at org.apache.xerces.parsers.XML11Configuration.parse(Unknown Source)
    at org.apache.xerces.parsers.XMLParser.parse(Unknown Source)
    at org.apache.xerces.parsers.DOMParser.parse(Unknown Source)
    at org.apache.xerces.jaxp.DocumentBuilderImpl.parse(Unknown Source)
    at javax.xml.parsers.DocumentBuilder.parse(Unknown Source)
    at org.opensaml.xml.parse.BasicParserPool$DocumentBuilderProxy.parse(BasicParserPool.java:671)
    at org.opensaml.xml.parse.BasicParserPool.parse(BasicParserPool.java:215)
    ... 58 more

我对示例应用程序所做的唯一更改是更改metadata_url_for dict，使其具有'example-okta-com'键，其值为Okta doc步骤10中的元数据URL。

Answer 1

Okta中的应用程序需要配置为接受压缩的SAML AuthN请求。

我道歉，我应该把它放在文档中。我很快就会这样做。

与此同时，您需要在设置的Okta应用程序中将“请求压缩”设置为“压缩”。这是什么样的：