Re: [keycloak-user] SAML Token contains carriage returns (&#xD)

The original poster was seeing unexpected carriage returns in the SAML message emitted by Keycloak. I just discovered another issue where Keycloak inserts line feeds in HTTP-Redirect messages in violation of the SAML spec causing some SAML implementations to fail to process the message. I filed this JIRA to cover the case: https://issues.jboss.org/browse/KEYCLOAK-8594 On 10/3/18 3:45 AM, Hynek Mlnarik wrote: What I find interesting in the XML Dean shared below is the carriage returns are not uniformly appearing at each line ending as one might expect. Rather they only appear in the signature digest and X509Certificate values. My guess is these values are being inserted as strings into string data and those particular string values have Windows line-endings. However the carriage returns should not cause the XML parser to fail, see this part of the XML spec: https://www.w3.org/TR/REC-xml/#sec-line-ends What is also interesting is the values with carriage returns in them are base64 data. So Websphere might be having a similar problem as in the above JIRA where is aborts after seeing a character not in the base64 alphabet. However this is quite different than the JIRA reported above, read on... Also note the SAML Core spec says this: And furthermore the XML Signature Specification reiterates the above with this requirement As for the Digest and X509Certificate elements (as well as anything else contained in XML Signature elments the XML Signature spec does not place restrictions on line endings other than noted above. With respect to base64 encoded data in XML signature elements the only requirement is the base64 text comply with RFC 2045 which not only permits line endings but requires wrapping at 76 characters *and* states any character not in the base64 alphabet is to be ignored. Therefore my conclusion is that if WebSphere is unable to process the XML document with the carriage returns it is not spec compliant. Note this is very different that the JIRA filed above with respect to whitespace in base64 data because the SAML binding spec *requires* the base64 text to omit whitespace (a deviation from RFC 2045). -- John Dennis