I have seen SEVERE logs related to invalid SAML XML in my CloudBees CI instance

1 minute readKnowledge base

Issue

I have seen lately the below stack traces in my CloudBees CI logs and I am worried that it can affect my users' login.

SEVERE n.s.u.j.s.x.LoggingErrorHandler#fatalError: XML Parsing Error SEVERE o.o.s.m.r.i.AbstractReloadingMetadataResolver#unmarshallMetadata: Metadata Resolver FilesystemMetadataResolver org.opensaml.saml.metadata.resolver.impl.FilesystemMetadataResolver: Unable to unmarshall metadata: net.shibboleth.utilities.java.support.xml.XMLParserException: Unable to parse inputstream, it contained invalid XML SEVERE o.o.s.m.r.i.AbstractReloadingMetadataResolver#refresh: Metadata Resolver FilesystemMetadataResolver org.opensaml.saml.metadata.resolver.impl.FilesystemMetadataResolver: Error occurred while attempting to refresh metadata from '/var/jenkins_home/saml-sp-metadata.xml' org.xml.sax.SAXParseException; lineNumber: 1; columnNumber: 1; Premature end of file. [...] Caused: net.shibboleth.utilities.java.support.xml.XMLParserException: Unable to parse inputstream, it contained invalid XML

Resolution

Those aforementioned logs are indicating a corruption in the file called saml-sp-metadata.xml. At first glance, it should not cause any disturbance at the users' login unless some change in the metadata is introduced.

To get rid of those logs, rename the file $JENKINS_HOME/saml-sp-metadata.xml to $JENKINS_HOME/saml-sp-metadata.backup.xml (or similar, just to keep the file as a backup), then navigate in the UI under Manage Jenkins → Security → Security Realm and click on the link called Service Provider Metadata as shown in the screenshot below. This should regenerate the file $JENKINS_HOME/saml-sp-metadata.xml from scratch.

Service Provide Metadata link

Tested product/plugin versions