SAML / OIF integration does not work - Could not extract SAML2 message

Question

Hi gurus,
We are trying to establish SSO between SAP Portal 7.3 and OIF 11.1.5 (Oracle Identity federation). I configured SAP Portal as service provider and OIF is also configured. I changed Login Module and add SAMl as on top of my default auth stack. When we try to do end-to-end test is does not work and throws the following error:
Default SAML2 configuration is selected because login module option [provider] is not configured.
SAML2LoginModule is running in execution mode DEFAULT.
SAML2Principal not found in current client context.
Exiting method
Entering method
SAMLResponse: PHNhbWxwOlJlc3BvbnNlIHhtbG5zOnNhbWxwPSJ1cm46b2FzaXM6bmFtZXM6dGM6
<BR>U0FNTDoyLjA6cHJvdG9jb2wiIERlc3RpbmF0aW9uPSJodHRwczovL2ppZXB0ODIu
<BR>dWsuY2VudHJpY2FwbGMuY29tOjgxODIvc2FtbDIvc3AvYWNzIiBJRD0iaWQtVVRW...........................
Decoded SAMLResponse: <samlp:Response mlns:samlp="urn:oasis:names:tc:  4 пїЅГЈ"пїЅ пїЅ &пїЅFпїЅ6пїЅпїЅ" FW7FпїЅпїЅ.......................3E&saml2post=false
Could not extract SAML2 message from request.
[EXCEPTION]
java.lang.SecurityException: com.sap.security.saml2.lib.common.SAML2Exception: SAML parsing failed..................
No user name provided.
Entering method
Automatic IdP Selection mode configured for the Service Provider
POST parameters set as HTTP request attribute [sap.com/login_post_parameters] to be re-submitted during login: [SAMLResponse, SAMLart, RelayState]
Could not remove original application URL cookie because the provided name is invalid: <null>
Exiting method with true
LOGIN.FAILED
User: N/A
IP Address: 10.11.11.11
Authentication Stack: ticket
Login Module                                                               Flag        Initialize  Login      Commit     Abort      Details
1. com.sap.security.saml2.sp.SAML2LoginModule                              REQUIRED    ok          exception             true       Service Provider could not extract SAML2 message from request.
        #1 AcceptedAuthenticationMethods = *
        #2 Mode = Standalone
2. com.sap.security.core.server.jaas.EvaluateTicketLoginModule             SUFFICIENT  ok          false                 true      
        #1 trusteddn1 = CN=ERT,OU=I0020100174,O=SAP Web AS
        #2 trustediss1 = CN=ERT,OU=I0020100174,O=SAP Web AS
        #3 trustedsys1 = ERT,010
        #4 ume.configuration.active = true
3. com.sap.engine.services.security.server.jaas.BasicPasswordLoginModule   REQUISITE   ok          false                 false     
4. com.sap.security.core.server.jaas.CreateTicketLoginModule               OPTIONAL    ok          false                 true      
Decoded SAMl response looks strange with all non-readable characters and as a result, there is no username passed to the portal and SAML login fails and portal offers a fall-back login with username/password
Also, can you please comment the line from the help.sap.com (http://help.sap.com/saphelp_nw73/helpdata/en/bf/b0b879544740c8a3c8bdda87e50587/frameset.htm)
"Prerequisites for SAML
"Your service provider must be able to reach the identity provider over HTTP or HTTPS." "
We have our identity provider / service provider in two different segment of the network and there is no http/https connection between these segments as we assumed that all the communication is going through the browser and we would not need the port to be opened on the firewall. Is it something which is absolutely necessary? In our opinion it negates all the benefits of SAML
Help will be very much appreciated
Many thanks in advance,
Regards, Elena

Answer 1

Hi Elena,
The issue was discovered and fixed during the SAML Interoperability Tests early last year (2011). I'm not sure I will be able to find a dedicated note because the fix was not downported but just submitted in the latest SP in correction. If you need a justification then you can open a support ticket with SAP and this will be the official answer there. If you do so please to not forget to attach traces from the system - use the tool described in 1332726 with type "SAML 2.0 (Info)". If you send me the ticket number I can speed-up the processing of the ticket.
Regards,
Dimitar