Upgrading to TKGI v1.25.3 can cause UAA to fail to start

Products

• VMware Tanzu Kubernetes Grid Integrated Edition

Issue/Introduction

After upgrading to TKGI v1.25.3 when using SAML authentication,  the UAA job on the PKS VM can fail to start.

Task xxxx | 12:04:55 | L starting jobs: pivotal-container-service/xxxxx (1) (canary) (00:05:34)
                       L Error: 'pivotal-container-service/xxxxxx (1)' is not running after update. Review logs for failed jobs: uaa

Looking at the UAA logs on the VM shows an error like so:

Caused by: org.opensaml.core.xml.io.UnmarshallingException: Saw invalid element content '...' of element {http://www.w3.org/2000/09/xmldsig#}X509Data

Environment

TKGI 1.25.3

Cause

Starting in UAA v78.15.0 (which is included in TKGI 1.25.3), the OpenSAML library was upgraded to OpenSAML 5. This enforces a stricter validation mode that rejects unexpected XML content. If the SAML IDP metadata configured in UAA is malformed, for example a truncated or corrupted copy of the original metadata, UAA now fails to start instead of tolerating it, as it would in previous versions.

Resolution

There are two options for resolving this:

• Re-fetch the complete, unmodified IDP metadata from the identity provider and update the UAA configuration in the TKGI tile -> UAA -> Provider Metadata
• Configure UAA to fetch the metadata directly from the IDP URL instead of pasting it in, and confirm the URL returns valid metadata. ( TKGI tile -> UAA -> Provider Metadata URL)

Please note, if you configure both of the above options, your IDP defaults to the Provider Metadata URL.