Shibboleth XML Configuration file Validation

[Mark O'Quinn]

Scott, Brent Thank you very much!

I've found the solution in the SpringDocumentLoader and ClassPathResolver classes, which I use in order to validate some of the configuration XML files based on the schemas in the classpath, which is great because I don't have to specify the entire set of schemas manually (like I was originally doing).

Now, my next step is to look at the SpringConfigurationUtils in order to understand the validation via Spring and specially find the way of reloading some of the configuration files on demand instead of time intervals. 

Thanks for all your help.

Cheers.

On Sep 21, 2012, at 2:44 PM, Brent Putman wrote:

> 
> On 9/21/12 11:38 AM, Cantor, Scott wrote:
>> On 9/21/12 8:45 AM, "Mark O'Quinn" <mark1oquinn at gmail.com> wrote:
>>> I've been wondering if I should use the Shibboleth's class in charge of
>>> this process instead of validating the XMLs myself. I assume that can be
>>> done, because Shibboleth at some point needs to validate the xml (based
>>> on the schemas) in order to start the idp. I've been looking the class
>>> SAMLMDRelyingPartyConfigurationManager to check the validation of the
>>> relying-party.xml file.
>> The parsing code is much deeper, it's down in xmltooling I would think. 
> 
> There is support in OpenSAML for doing DOM schema validation, but that
> is mostly geared towards validating SAML documents.  See for example
> org.opensaml.common.xml.SAMLSchemaBuilder (which bundles a lot of SAML
> 1.1 and 2.0 schemas up into a Schema object) as well as the more generic
> org.opensaml.xml.schema.SchemaBuilder.java (just a general helper class).
> 
> However, the validation of the XML config files in the IdP isn't handled
> by any of that code. All those XML files are loaded by Spring using
> their custom bean definition support stuff.  So those get handled in the
> Spring layer.  I think what the OP probably wants to look at is:
> 
> edu.internet2.middleware.shibboleth.common.config.SpringDocumentLoader
> 
> Note that that is DOM JAXP based, so uses DocumentBuilders and so on, as
> opposed to your original SAX question.
> 
> If you want to see how it's actually used, see:
> 
> edu.internet2.middleware.shibboleth.common.config.SpringConfigurationUtils
> 
> I don't know if you can use the document loader as-is, but at least it
> will give you some idea of how we (via Spring) are doing the validation.
> 
> 
>> I
>> know there's entity resolution code that's doing the classpath-based
>> lookups of the schemas, which I would think is in xmltooling, but I guess
>> could be somewhere else. 
> 
> Yes, the above Spring document loader bakes in use of our custom
> classpath entity resolver, which is in xmltooling:
> org.opensaml.xml.parse.ClasspathResolver.
> 
> 
> 
> 
> --
> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net