# Saml2 response not conforming to the spec

**URL:** <https://community.auth0.com/t/saml2-response-not-conforming-to-the-spec/55921>\
**Category:** Get Help\
**Created:** [January 8, 2021, 7:21pm UTC](https://community.auth0.com/t/saml2-response-not-conforming-to-the-spec/55921 "2021-01-08T19:21:47Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ikakavas](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ikakavas/32/26771_2.png) [@ikakavas](https://community.auth0.com/u/ikakavas)\
**Post date:** [January 8, 2021, 7:21pm UTC](https://community.auth0.com/t/saml2-response-not-conforming-to-the-spec/55921/1 "2021-01-08T19:21:47Z")

</div>

Hi there folks,

With Auth0 acting as a SAML IDP, and when the saml response indicates a failure, the XML that Auth0 produces is not valid. For instance consider the following message:

```auto
 <samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="_anid" InResponseTo="_authnreq_id" Version="2.0" IssueInstant="2021-01-04T09:21:52.037Z" Destination="https://the.sp.acs.here"><saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">urn:tenant.auth0.com</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Responder"/><samlp:StatusMessage Value="user is blocked"/></samlp:Status></samlp:Response>

```

The problem is that StatusMessage is not allowed to have any attributes as it is supposed to be a simple type. For reference, the xsd is available [here](https://docs.oasis-open.org/security/saml/v2.0/saml-schema-protocol-2.0.xsd)

```auto
<samlp:StatusMessage Value="user is blocked"/>

```

should be

```auto
<samlp:StatusMessage>user is blocked</samlp:StatusMessage>

```

When a SP that does schema validation, attempts to parse this message it will fail, for instance, in Java, SAXParser throws

```auto
SAXParseException[cvc-type.3.1.1: Element 'samlp:StatusMessage' is a simple type, so it cannot have attributes, excepting those whose namespace name is identical to 'http://www.w3.org/2001/XMLSchema-instance' and whose [local name] is one of 'type', 'nil', 'schemaLocation' or 'noNamespaceSchemaLocation'. However, the attribute, 'Value' was found.];)

```

Thanks,  
Ioannis

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [January 8, 2021, 8:12pm UTC](https://community.auth0.com/t/saml2-response-not-conforming-to-the-spec/55921/3 "2021-01-08T20:12:44Z")

</div>

Thanks for the feedback. I created a ticket for our engineering team to review. I’ll update here with my findings.

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ikakavas/32/26771_2.png) [@ikakavas](https://community.auth0.com/u/ikakavas)\
**Post date:** [January 9, 2021, 1:41pm UTC](https://community.auth0.com/t/saml2-response-not-conforming-to-the-spec/55921/5 "2021-01-09T13:41:24Z")

</div>

Thanks for the swift reply here Dan. Cheers

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [January 25, 2021, 8:48pm UTC](https://community.auth0.com/t/saml2-response-not-conforming-to-the-spec/55921/6 "2021-01-25T20:48:52Z")

</div>

This was added to our backlog. Thanks for reporting.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [February 9, 2021, 8:48pm UTC](https://community.auth0.com/t/saml2-response-not-conforming-to-the-spec/55921/7 "2021-02-09T20:48:54Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.