OpenSAML and Apache Santuario (xmlsec) 1.5.1

[Brent Putman]

On 4/12/12 2:52 PM, Brent Putman wrote:
>
>> It's strange because when I call the setIdAttribute(..) directly
>> before doc.getElementById() it works. Maybe there are some
>> modifications done on the DOM tree (copying or some such) so that it
>> does not remember that "ID" is an id?
> That would definitely cause it.  I can't think of where or how that
> would be happening in OpenSAML itself, but it's possible.  Perhaps it's
> a side effect of how you are running this. 


I did think of one issue that causes the ID-ness to be effectively lost,
at least it causes Document#getElementById to fail.  If the Element in
question is not in the tree of nodes rooted at the document root element
(i.e. Document#getDocumentElement()), then Document#getElementById won't
find it.  In other words, if it's "orphaned" and isn't a descendent of
its owning Document's root element, then it's not found via DOM search.

One way this can happen is with Decryption.  There's some extensive
Javadocs in the OpenSAML Decrypter class.  See the several paragraphs
beginning with " In both of these cases the underlying DOM Element...":

http://svn.shibboleth.net/view/java-xmltooling/branches/REL_1/src/main/java/org/opensaml/xml/encryption/Decrypter.java?view=markup

Whether or not you are doing decryption here (e.g. of the Assertion from
an EncryptedAssertion in the Response), if for some reason your Element
isn't a descendent of its owning Document's root Element, then that can
cause this issue.

Just a thought.

--Brent



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20120412/91e87e6f/attachment.html