Mailing-List: contact users-help@cloudstack.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@cloudstack.apache.org
MIME-Version: 1.0
In-Reply-To: <67721128.2901885.1462907057561.JavaMail.zimbra@rsantos.eti.br>
References: <67721128.2901885.1462907057561.JavaMail.zimbra@rsantos.eti.br>
Date: Tue, 10 May 2016 22:24:13 +0200
Message-ID: <CAP997Ue6xHiHQ2_fT-ofX=riqo8g8zkBEjEUMUQ7_VxmDSA+UQ@mail.gmail.com>
Subject: Re: ADFS + CloudStack problem
From: Erik Weber <terbolous@gmail.com>
To: "users@cloudstack.apache.org" <users@cloudstack.apache.org>
Content-Type: multipart/alternative; boundary=001a11c3fe825963f9053282b576
archived-at: Tue, 10 May 2016 20:24:21 -0000

--001a11c3fe825963f9053282b576
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

I haven't tried since I wrote that post, but it worked back then.

Any chance that you could translate the error messages?

Erik

Den tirsdag 10. mai 2016 skrev Igor S. Lopes <igor@rsantos.eti.br> f=C3=B8l=
gende:

> Hi,
> I am working with CloudStack and I'm indending to use it as a Service
> Provider connected through SSO with our Active Directory Federation Servi=
ce
> .
> I have no Idea how to allow CloudStack to authenticate on the ADFS .
> I tried to follow this guide
> http://www.terbolo.us/2015/06/how-to-set-up-apache-cloudstack-4-5-24-6-0-=
and-saml-2-0-authentication-against-microsoft-adfs/
> but
> a few problems showed up:
>
> 1 - Even though I had set the URL metadata to https://<domain>/Federation=
Metadata/2007-06/FederationMetadata.xml
> when I checked /var/log/cloudstack/management/management-server.log
> for error messages I saw a few saying that CloudStack couldn't retrieve
> the metadata file. So I did it manually.
>
> 2 - I configured the ADFS claims as showed in the 'how-to' but the
> following error message shows up on my ADFS Event Logs. I already spent a
> couple hours browsing about this error but
> nothing really usefull came up:
>
> Error code: 364
> (...)
> System.Xml.XmlException: MSIS0018: N=C3=A3o =C3=A9 poss=C3=ADvel ler a me=
nsagem do
> protocolo SAML porque ela cont=C3=A9m dados inv=C3=A1lidos. --->
> System.ArgumentException: ID4128: O valor n=C3=A3o =C3=A9 um ID de SAML v=
=C3=A1lido.
> Nome do par=C3=A2metro: value ---> System.Xml.XmlException: Um nome n=C3=
=A3o pode
> ser iniciado pelo caractere '7', valor hexadecimal 0x37.
> em System.Xml.XmlConvert.VerifyNCName(String name, ExceptionType
> exceptionType)
> em Microsoft.IdentityModel.Tokens.Saml2.Saml2Id..ctor(String value)
> --- Fim do rastreamento de pilha de exce=C3=A7=C3=B5es internas ---
> em Microsoft.IdentityModel.Tokens.Saml2.Saml2Id..ctor(String value)
> em
> Microsoft.IdentityServer.Protocols.Saml.SamlProtocolSerializer.ReadCommon=
Attributes(XmlReader
> reader, SamlMessage message)
> --- Fim do rastreamento de pilha de exce=C3=A7=C3=B5es internas ---
> em
> Microsoft.IdentityServer.Protocols.Saml.SamlProtocolSerializer.ReadCommon=
Attributes(XmlReader
> reader, SamlMessage message)
> em
> Microsoft.IdentityServer.Protocols.Saml.SamlProtocolSerializer.ReadAuthnR=
equest(XmlReader
> reader)
> em
> Microsoft.IdentityServer.Protocols.Saml.SamlProtocolSerializer.ReadSamlMe=
ssage(XmlReader
> reader, NamespaceContext context)
> em
> Microsoft.IdentityServer.Protocols.Saml.HttpSamlBindingSerializer.ReadPro=
tocolMessage(String
> encodedSamlMessage)
> em
> Microsoft.IdentityServer.Protocols.Saml.HttpSamlBindingSerializer.CreateF=
romNameValueCollection(Uri
> baseUrl, NameValueCollection collection)
> em
> Microsoft.IdentityServer.Protocols.Saml.HttpRedirectSamlBindingSerializer=
.ReadMessage(Uri
> requestUrl, NameValueCollection form)
> em
> Microsoft.IdentityServer.Web.Protocols.Saml.HttpSamlMessageFactory.Create=
Message(WrappedHttpListenerRequest
> httpRequest)
> em
> Microsoft.IdentityServer.Web.Protocols.Saml.SamlContextFactory.CreateProt=
ocolContextFromRequest(WrappedHttpListenerRequest
> request, ProtocolContext& protocolContext)
> em
> Microsoft.IdentityServer.Web.Protocols.Saml.SamlProtocolHandler.CreatePro=
tocolContext(WrappedHttpListenerRequest
> request)
> em
> Microsoft.IdentityServer.Web.PassiveProtocolListener.GetProtocolHandler(W=
rappedHttpListenerRequest
> request, ProtocolContext& protocolContext, PassiveProtocolHandler&
> protocolHandler)
> em
> Microsoft.IdentityServer.Web.PassiveProtocolListener.OnGetContext(Wrapped=
HttpListenerContext
> context)
>
> System.ArgumentException: ID4128: O valor n=C3=A3o =C3=A9 um ID de SAML v=
=C3=A1lido.
> Nome do par=C3=A2metro: value ---> System.Xml.XmlException: Um nome n=C3=
=A3o pode
> ser iniciado pelo caractere '7', valor hexadecimal 0x37.
> em System.Xml.XmlConvert.VerifyNCName(String name, ExceptionType
> exceptionType)
> em Microsoft.IdentityModel.Tokens.Saml2.Saml2Id..ctor(String value)
> --- Fim do rastreamento de pilha de exce=C3=A7=C3=B5es internas ---
> em Microsoft.IdentityModel.Tokens.Saml2.Saml2Id..ctor(String value)
> em
> Microsoft.IdentityServer.Protocols.Saml.SamlProtocolSerializer.ReadCommon=
Attributes(XmlReader
> reader, SamlMessage message)
>
> System.Xml.XmlException: Um nome n=C3=A3o pode ser iniciado pelo caracter=
e '7',
> valor hexadecimal 0x37.
> em System.Xml.XmlConvert.VerifyNCName(String name, ExceptionType
> exceptionType)
> em Microsoft.IdentityModel.Tokens.Saml2.Saml2Id..ctor(String value)
>
>
> There is a few parts in brazilian portuguese, sorry about that.
> Did anyone succeeded in connecting CloudStack to an ADFS using the Saml
> plugin?
>
> Thank you in advance.
>
> Igor Steuck Lopes
>
> --
> Este email foi checado por SOPHOS UTM 9 SPAM &amp; Virus Firewall.
> http://www.rsantos.eti.br
>

--001a11c3fe825963f9053282b576--