Google SAML changed from xs:anyType to xsd:anyType

[mt-sergio]

We are using version 10.1.0 (2589bef1).
Since July 12, our SAML integration with Google suddenly stop, returning the error

Signature verification failed. Invalid document format.

The error is coming from https://github.com/sissaschool/xmlschema/blob/master/xmlschema/validators/global_maps.py#L273 with exactly this information

xmlschema.exceptions.XMLSchemaKeyError: "global xs:simpleType/xs:complexType 'xsd:anyType' not found"

I debugged our platform, and there is a subtle change in the SAML response from the Google server.
From

            <saml2:Attribute Name="FirstName">
                <saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema"
                                      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:anyType">AAA
                </saml2:AttributeValue>
            </saml2:Attribute>
            <saml2:Attribute Name="LastName">
                <saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema"
                                      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:anyType">
                    BBB
                </saml2:AttributeValue>
            </saml2:Attribute>

To

            <saml2:Attribute Name="FirstName">
                <saml2:AttributeValue xmlns:xsd="http://www.w3.org/2001/XMLSchema"
                                      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:anyType">CCC
                </saml2:AttributeValue>
            </saml2:Attribute>
            <saml2:Attribute Name="LastName">
                <saml2:AttributeValue xmlns:xsd="http://www.w3.org/2001/XMLSchema"
                                      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:anyType">
                    DDD
                </saml2:AttributeValue>
            </saml2:Attribute>

The first one was working, but the second one was not.

I don't recall to have modified anything on our Google Workspace SAML configuration.

Any idea? Whatever insight will help me to move into the right direction.

[mt-sergio]

Solution: We had hardcoded in our Dockerfile the PySAML2 version 6.5.0. We just had to upgrade to 6.5.2 (6.5.1 fixed it).