SAML Auth Fails After Upgrading to OpsMan to 3.3.4 (UAA 2.15.0) When the SAML metadata response contains a UTF-8 byte-order-mark (BOM)

Products

• VMware Tanzu Platform Core

Issue/Introduction

After upgrading Tanzu Operations Manager to v3.3.4, all attempts to log in via SAML SSO fail. Every login attempt redirects to /uaa/saml2/authenticate/<idp-alias> and returns an error instead of continuing on to the identity provider:

Unable to build SAML relying party registration for: <idp-alias>

No redirect to the identity provider is attempted and the failure occurs entirely within UAA before an AuthnRequest can be built. The following is also seen in uaa.log:

org.springframework.security.saml2.Saml2Exception: Unable to build SAML relying party registration for: <idp-alias>
Caused by: java.io.FileNotFoundException: class path resource [<?xml version="1.0" encoding="utf-8"?><EntityDescriptor ...>] cannot be opened because it does not exist
 at org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrations.fromMetadataLocation
 at org.cloudfoundry.identity.uaa.provider.saml.RelyingPartyRegistrationBuilder.buildRelyingPartyRegistration

Environment

Tanzu Operations Manager 3.3.4 (UAA 2.15.0, UAA core v79.3.2)

Cause

This is caused by a recent UAA change to honor the skipSslValidation setting when fetching SAML IdP metadata during login (introduced in UAA 2.15.0 / core v79.3.2). Microsoft Entra ID's federation metadata endpoint returns its response with a leading UTF-8 byte-order-mark (U+FEFF). This is normal behavior on Entra's side.

As part of the change above, UAA's logic for classifying fetched/stored metadata (as inline XML data vs. a resource location) no longer correctly accounts for this leading BOM character. Because the BOM sits in front of the XML declaration, UAA fails to recognize the response as valid metadata content and instead attempts to resolve the entire metadata document as if it were a file/classpath location, resulting in the FileNotFoundException above.

 

 

Resolution

R&D has confirmed this root cause and is actively working on a permanent fix. Until it is available, please use the workaround below:

1. Reconfigure the IdP definition in Ops Manager to use the metadata XML content directly instead of the metadata URL.  Download the metadata, remove the leading invisible BOM character, and paste the cleaned XML into the metadata field.
   • Note: if Entra ID is configured to auto-rotate its certificate, this static copy will not pick up rotations automatically and will need to be refreshed manually going forward. This option should be treated as a fallback if the Entra-side encoding setting in option 1 isn't available or adjustable.

 

Note: Issue is resolved as of Tanzu UAA version 2.16. Tentatively planned to be fixed in the Tanzu Platform Operation Manager release 3.3.5 or later".