为什么这不是有效的saml2请求？

Question

I am using Opensaml to generate a saml2 authentication request for azure

<?xml version="1.0" encoding="UTF-8"?>
<samlp:AuthnRequest AssertionConsumerServiceURL="https://myserver.de/_saml/validate/azure"
ForceAuthn="false" ID="0" IsPassive="false" IssueInstant="2016-11-28T09:46:43.215Z"
ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Version="2.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
<samlp:Issuer xmlns:samlp="urn:oasis:names:tc:SAML:2.0:assertion">issuerid</samlp:Issuer>
<saml2p:NameIDPolicy AllowCreate="true"
    Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
    SPNameQualifier="Isser" xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" />
<saml2p:RequestedAuthnContext Comparison="exact"
    xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol">
    <saml:AuthnContextClassRef xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef>
</saml2p:RequestedAuthnContext>
</samlp:AuthnRequest>

The XML was encoded with org.opensaml.xml.io.Marshaller and java.util.zip.DeflaterOutputStream.DeflaterOutputStream to Base64 and i verified it by using some online saml decoders for correctnes.

The error i get from azure however is:

AADSTS75005: The request is not a valid Saml2 protocol message.

Anyone can help?

Answer 1

In the element 'AuthnRequest' you define the attribute 'ID' as '0'. This is not a valid value of the atomic type 'xs:ID'.

I quote the technical rule of Oasis document:

The xs:ID simple type is used to declare SAML identifiers for assertions, requests, and responses. Values declared to be of type xs:ID in this specification MUST satisfy the following properties in addition to those imposed by the definition of the xs:ID type itself:

• Any party that assigns an identifier MUST ensure that there is negligible probability that that party or any other party will accidentally assign the same identifier to a different data object.
• Where a data object declares that it has a particular identifier, there MUST be exactly one such declaration.

The mechanism by which a SAML system entity ensures that the identifier is unique is left to the implementation. In the case that a random or pseudorandom technique is employed, the probability of two randomly chosen identifiers being identical MUST be less than or equal to 2-128 and SHOULD be less than or equal to 2-160.

You should use one of the existing way to generate the ID.