<style>
/* Changing the layout to use less space for mobiles */
@media screen and (max-device-width: 480px), screen and (-webkit-min-device-pixel-ratio: 2) {
#email-body { min-width: 30em !important; }
#email-page { padding: 8px !important; }
#email-banner { padding: 8px 8px 0 8px !important; }
#email-avatar { margin: 1px 8px 8px 0 !important; padding: 0 !important; }
#email-fields { padding: 0 8px 8px 8px !important; }
#email-gutter { width: 0 !important; }
}
</style>
<div id="email-body">
<table id="email-wrap" align="center" border="0" cellpadding="0" cellspacing="0" style="background-color:#f0f0f0;color:#000000;width:100%;">
<tr valign="top">
<td id="email-page" style="padding:16px !important;">
<table align="center" border="0" cellpadding="0" cellspacing="0" style="background-color:#ffffff;border:1px solid #bbbbbb;color:#000000;width:100%;">
<tr valign="top">
<td bgcolor="#ffffff" style="background-color:#ffffff;color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;line-height:1;"><img src="https://shibboleth.net/images/shib_240x83.png" alt="" style="vertical-align:top;" /></td>
</tr><tr valign="top">
<td id="email-banner" style="padding:32px 32px 0 32px;">
<table align="left" border="0" cellpadding="0" cellspacing="0" width="100%" style="width:100%;">
<tr valign="top">
<td style="color:#505050;font-family:Arial,FreeSans,Helvetica,sans-serif;padding:0;">
<img id="email-avatar" src="https://issues.shibboleth.net/jira/secure/useravatar?ownerId=ian%40iay.org.uk&avatarId=10125" alt="" height="48" width="48" border="0" align="left" style="padding:0;margin: 0 16px 16px 0;" />
<div id="email-action" style="padding: 0 0 8px 0;font-size:12px;line-height:18px;">
<a class="user-hover" rel="ian@iay.org.uk" id="email_ian@iay.org.uk" href="https://issues.shibboleth.net/jira/secure/ViewProfile.jspa?name=ian%40iay.org.uk" style="color:#326ca6;">Ian Young</a>
commented on <img src="https://issues.shibboleth.net/jira/images/icons/issuetypes/bug.png" height="16" width="16" border="0" align="absmiddle" alt="Bug"> <a style='color:#326ca6;text-decoration:none;' href='https://issues.shibboleth.net/jira/browse/OSJ-106'>OSJ-106</a>
</div>
<div id="email-summary" style="font-size:16px;line-height:20px;padding:2px 0 16px 0;">
<a style='color:#326ca6;text-decoration:none;' href='https://issues.shibboleth.net/jira/browse/OSJ-106'><strong>schema validation can prevent use of metadata</strong></a>
</div>
</td>
</tr>
</table>
</td>
</tr>
<tr valign="top">
<td id="email-fields" style="padding:0 32px 32px 32px;">
<table border="0" cellpadding="0" cellspacing="0" style="padding:0;text-align:left;width:100%;" width="100%">
<tr valign="top">
<td id="email-gutter" style="width:64px;white-space:nowrap;"></td>
<td>
<table border="0" cellpadding="0" cellspacing="0" width="100%">
<tr valign="top">
<td colspan="2" style="color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;padding:0 0 16px 0;width:100%;">
<div class="comment-block" style="background-color:#edf5ff;border:1px solid #dddddd;color:#000000;padding:12px;"><p>The root of this problem turns out not to be to do with any of the things I thought, but an API contract mismatch between the following classes:</p>
<ul>
<li><tt>net.shibboleth.utilities.java.support.xml.SchemaBuilder</tt></li>
<li><tt>org.opensaml.saml.common.xml.SAMLSchemaBuilder</tt></li>
</ul>
<p>A <tt>SchemaBuilder</tt> bean is handed a set of <tt>Source</tt> objects and constructs a <tt>Schema</tt> from them. The streams within the <tt>Source</tt> objects are consumed <b>and I believe closed by JAXP</b> during this operation, which means that the <tt>buildSchema</tt> method should only ever be called once. We might give some thought to having it throw an <tt>IllegalStateException</tt> if its <tt>buildSchema</tt> method is called more than once to have this fail more helpfully.</p>
<p><tt>SAMLSchemaBuilder</tt> attempts to save resources by using a <tt>SoftReference</tt> to hold the built schema for reuse. If the <tt>SoftReference</tt> is cleared by the garbage collector, the <tt>SchemaBuilder</tt>'s <tt>buildSchema</tt> method will be called a second time and this will result in an exception. In the context this appears in an IdP configuration, this will prevent a metadata provider configured to schema-validate metadata from returning any subsequent metadata until the IdP is restarted.</p>
<div class="code panel" style="border-width: 1px;"><div class="codeContent panelContent">
<pre class="code-java">@Nonnull <span class="code-keyword">public</span> <span class="code-keyword">synchronized</span> Schema getSAMLSchema() <span class="code-keyword">throws</span> SAXException {
<span class="code-keyword">if</span> (cachedSchema == <span class="code-keyword">null</span> || cachedSchema.get() == <span class="code-keyword">null</span>) {
cachedSchema = <span class="code-keyword">new</span> SoftReference<>(schemaBuilder.buildSchema());
}
<span class="code-keyword">return</span> cachedSchema.get();
}
</pre>
</div></div>
<p>Fixing things at the <tt>SAMLSchemaBuilder</tt> level could be done in several ways:</p>
<ul>
<li>decide not to use a <tt>SoftReference</tt> at all, and just accept that the space the <tt>Schema</tt> takes up will be fixed</li>
<li>build and configure a new <tt>SchemaBuilder</tt> each time the <tt>SoftReference</tt> appears empty</li>
</ul>
<p>I've marked this as a blocker for V3.1.0 because this seems to me like a regression from V2, and one which could affect any deployment using metadata schema validation. The only way to avoid the problem would be to not use metadata schema validation at all, as there is no way to ensure that the problem won't arise otherwise as you're in the hands of the details of the garbage collector implementation which is not under our control. Obviously the problem appears on my IdP because I'm being deliberately mean about memory availability, and because I do validation every time the dynamic metadata provider is used, but I'm pretty sure this will randomly hit other more conventional deployments eventually as well.</p></div>
<div style="color:#505050;padding:4px 0 0 0;"> </div>
</td>
</tr>
</table>
</td>
</tr>
</table>
</td>
</tr>
</table>
</td><!-- End #email-page -->
</tr>
<tr valign="top">
<td style="color:#505050;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:10px;line-height:14px;padding: 0 16px 16px 16px;text-align:center;">
This message is automatically generated by JIRA.<br />
If you think it was sent incorrectly, please contact your JIRA administrators<br />
For more information on JIRA, see: <a style='color:#326ca6;' href='http://www.atlassian.com/software/jira'>http://www.atlassian.com/software/jira</a>
</td>
</tr>
</table><!-- End #email-wrap -->
</div><!-- End #email-body -->