Shibboleth XML Configuration file Validation

[Brent Putman]

On 9/21/12 11:38 AM, Cantor, Scott wrote:
> On 9/21/12 8:45 AM, "Mark O'Quinn" <mark1oquinn at gmail.com> wrote:
>> I've been wondering if I should use the Shibboleth's class in charge of
>> this process instead of validating the XMLs myself. I assume that can be
>> done, because Shibboleth at some point needs to validate the xml (based
>> on the schemas) in order to start the idp. I've been looking the class
>> SAMLMDRelyingPartyConfigurationManager to check the validation of the
>> relying-party.xml file.
> The parsing code is much deeper, it's down in xmltooling I would think. 

There is support in OpenSAML for doing DOM schema validation, but that
is mostly geared towards validating SAML documents.  See for example
org.opensaml.common.xml.SAMLSchemaBuilder (which bundles a lot of SAML
1.1 and 2.0 schemas up into a Schema object) as well as the more generic
org.opensaml.xml.schema.SchemaBuilder.java (just a general helper class).

However, the validation of the XML config files in the IdP isn't handled
by any of that code. All those XML files are loaded by Spring using
their custom bean definition support stuff.  So those get handled in the
Spring layer.  I think what the OP probably wants to look at is:

edu.internet2.middleware.shibboleth.common.config.SpringDocumentLoader

Note that that is DOM JAXP based, so uses DocumentBuilders and so on, as
opposed to your original SAX question.

If you want to see how it's actually used, see:

edu.internet2.middleware.shibboleth.common.config.SpringConfigurationUtils

I don't know if you can use the document loader as-is, but at least it
will give you some idea of how we (via Spring) are doing the validation.


> I
> know there's entity resolution code that's doing the classpath-based
> lookups of the schemas, which I would think is in xmltooling, but I guess
> could be somewhere else. 

Yes, the above Spring document loader bakes in use of our custom
classpath entity resolver, which is in xmltooling:
org.opensaml.xml.parse.ClasspathResolver.