Saml2: Metadata read error "CData elements not valid at top level of an XML document. Line 1, position 3."

[keimpema]

Hi,

I have a problem with the metadata from https://was-preprod1.digid.nl/saml/idp/metadata . The xml parser cannot read it. Error is "CData elements not valid at top level of an XML document. Line 1, position 3." However, the xml looks fine to me.

What could be the problem? Any help would be much appreciated!

TIA
Harmen

code:

        // defined elsewhere
        DigidSettings.MetadataLocation = "https://was-preprod1.digid.nl/saml/idp/metadata";


        public static void ConfigureIdentityProviders(IAppBuilder app, string signInAsType)
        {
            var spOptions = new SPOptions
            {
                AuthenticateRequestSigningBehavior = SigningBehavior.Always,
                ServiceCertificates =
                {
                    new ServiceCertificate { Certificate = Certificates.DigidServiceProviderCertificate(), Use = CertificateUse.Signing }
                },
                EntityId = new EntityId(DigidSettings.AudienceUri), // from (B) above
            };

            var authServicesOptions = new KentorAuthServicesAuthenticationOptions(false)
            {
                SPOptions = spOptions,
                SignInAsAuthenticationType = signInAsType,
                AuthenticationType = "digid", // this is the "idp" - identity provider - that you can refer to throughout identity server
                Caption = "DigiD",  // this is the caption for the button or option that a user might see to prompt them for this login option   
            };

            var idp = new IdentityProvider(new EntityId(DigidSettings.IsseurUri), authServicesOptions.SPOptions)  // from (F) above
            {
                LoadMetadata = true,
                MetadataLocation = DigidSettings.MetadataLocation, // see Metadata note above
            };

            authServicesOptions.IdentityProviders.Add(idp);

            app.UseKentorAuthServicesAuthentication(authServicesOptions);
        }
    }

exception:

CData elements not valid at top level of an XML document. Line 1, position 3.
   at System.Xml.XmlExceptionHelper.ThrowXmlException(XmlDictionaryReader reader, XmlException exception)
   at System.Xml.XmlUTF8TextReader.Read()
   at Kentor.AuthServices.Metadata.FilteringXmlDictionaryReader.Read()
   at System.Xml.XmlReader.MoveToContent()
   at System.Xml.XmlReader.IsStartElement(String localname, String ns)
   at System.IdentityModel.Metadata.MetadataSerializer.ReadMetadataCore(XmlReader reader, SecurityTokenResolver tokenResolver)
   at System.IdentityModel.Metadata.MetadataSerializer.ReadMetadata(XmlReader reader, SecurityTokenResolver tokenResolver)
   at Kentor.AuthServices.Metadata.MetadataLoader.Load(Stream metadataStream)
   at Kentor.AuthServices.Metadata.MetadataLoader.Load(String metadataLocation)
   at Kentor.AuthServices.Metadata.MetadataLoader.LoadIdp(String metadataLocation, Boolean unpackEntitiesDescriptor)
   at Kentor.AuthServices.IdentityProvider.DoLoadMetadata()
   at Kentor.AuthServices.IdentityProvider.set_LoadMetadata(Boolean value)
   at Piramide.IdentityServer.Startup.ConfigureIdentityProviders(IAppBuilder app, String signInAsType) in C:\Project\IdentityServer\Main\Source\IdentityServer\Source\IdentityServer\Startup.cs:line 166
   at Owin.UseIdentityServerExtension.UseIdentityServer(IAppBuilder app, IdentityServerOptions options) in c:\local\identity\server3\IdentityServer3\source\Core\Configuration\AppBuilderExtensions\UseIdentityServerExtension.cs:line 88
   at Piramide.IdentityServer.Startup.<>c.<Configuration>b__0_2(IAppBuilder coreApp) in C:\Project\IdentityServer\Main\Source\IdentityServer\Source\IdentityServer\Startup.cs:line 131
   at Owin.MapExtensions.Map(IAppBuilder app, PathString pathMatch, Action`1 configuration)
   at Owin.MapExtensions.Map(IAppBuilder app, String pathMatch, Action`1 configuration)
   at Piramide.IdentityServer.Startup.Configuration(IAppBuilder app) in C:\Project\IdentityServer\Main\Source\IdentityServer\Source\IdentityServer\Startup.cs:line 79

[explunit]

It reads OK for me. Is there a proxy between the server where this metadata is attempted to be read? Note that metadataLocation can be a local path so you could try this possibility by downloading it separately and loading from local copy.

[kb99]

I ran into a very similar issue recently and tracked it down to the order that the properties on the IdentityProvider object are set.

var idp = new IdentityProvider(new EntityId(DigidSettings.IsseurUri), authServicesOptions.SPOptions)  // from (F) above   
{
      LoadMetadata = true,
      MetadataLocation = DigidSettings.MetadataLocation, // see Metadata note above
};

The MetadataLocation needs to be set before the LoadMetadata property. From debugging the source code I could see that as soon as the LoadMetadata property is set to true, it tries to load and validate the metadata. The MetadataLocation has not been set yet, so the code defaults back to the EntityId URL to try and load the metadata from. I believe according to the SAML spec, the metadata should be accessible from the entityId URL. If its not available, there will be no XML stream to parse and so you will receive the exception

CData elements not valid at top level of an XML document

You should be able to resolve your issue by simply swapping the order of the LoadMetadata and MetadataLocation properties so that the MetadataLocation property is set first.

[explunit]

Thanks @kb99 I didn't notice that detail

You can also simply omit the LoadMetadata = true since setting MetadataLocation automatically triggers this.

I'm not sure but possibly the changes to fix #658 will make this less error-prone.

[kjbetz]

Thanks, @kb99!

[kdmerkle]

Thank you @kb99. I was getting a MetadataSerializationException because the LoadMetadata property was being set before the MetadataLocation property. Switching the sequence fixed it.