SAML metadata validation issue in all 4.x instances

Environment:

gluu-server-4.1.0-centos7 (confirmed both for WrenDS and Couchbase, also confirmed for 4.0, and supposedly for 3.1.6 (according to Zico)).

Description:

Any new SAML TR doesn’t pass validation, and previously existing TR get broken if their metadata is updated. Somehow that doesn’t prevent IDP from functioning (i.e. SAML flows for all affected TRs seem to work), but this potentially may have further implications on existing setups.

Steps to reproduce:

1. Create a SAML TR for any SP (samltest.id will do)

2. Wait till validation will fail and open its properties page to see the detailed cause

Result:

TR doesn’t pass validation and error text like this is seen on its page:

src-resolve: Cannot resolve the name 'resolver:BasePrincipalConnectorType' to a(n) 'type definition' component.
Error of schema creating
Warning: cannot validate metadata. Check internet connetion ans www.w3.org availability.
Warning: Error of schema creating
Warning: src-resolve: Cannot resolve the name 'resolver:BasePrincipalConnectorType' to a(n) 'type definition' component.

Next Java error trace appears in oxtrust.log: link

[philzyk]

to tterrag109: rename your identity.war in /opt/gluu-server/opt/gluu/jetty/identity/webapps to identity.war.bak download https://ox.gluu.org/maven/org/gluu/oxtrust-server/4.1.1.Final/oxtrust-server-4.1.1.Final.war and rename it identity.war, then do service identity restart error for schema will gone and Validation status should change to green Success

[mzico]

For further assistance, open ticket / continue conversation in support.gluu.org ticket.