Shibboleth XML Configuration file Validation

[Mark O'Quinn]

Hi Brent,

I've finished to configure and setup the call to the services and reload them successfully!!! :) 

Next are the steps of the whole process:

1) I have a servlet configured to received the information of the SP that is about to be added (e.g. EntityID, AttributeFilterPolicy, etc.)

2) I make a backup of the configuration files of Shibboleth (Mainly relying-party.xml and attribute-filter.xml) and put these files in two folders: tmp/ and tmpConf/

3) I validate the XML (using the schemas from the classpath) of these files (from the tmp/ folder) using DocumentBuilder and related classes

4) With the information of the SP from the first step, I create new XML node(s) and add them to the respective configuration files. In here I also create the xml information that will go into the Metadata file.

5) Validate the XMLs with the newly added nodes (all of this from memory)

6) Once the previous step is successful I write the XML into the configuration files located in the tmp/ folder, overwriting the content of the files.

7) Copy the configuration files from the tmp/ folder to the conf/ folder, replacing the necessary files.

8) Using the HttpServletHelper I obtain the service beans from the ServletContext and reload the necessary services.

9) If something goes wrong, from the tmpConf/  folder (step 2) I copy and replace all the original configuration files to the conf/ folder and trigger the previous step (reload services) to leave everything as it was before step 1


Do you think there's something missing, wrong or that needs to be improved? Any suggestion is very welcome. 

Now, my next step is to add concurrency protection. I saw some lines (which I'll start study) in the class SAMLMDRelyingPartyConfigurationManager that I believe are the ones Shibboleth uses:

	Lock readLock = getReadWriteLock().readLock();
	readLock.lock();


Thank you very much for all your help and all the information.

Cheers!

-Mark


On Sep 24, 2012, at 6:15 PM, Brent Putman wrote:

> 
> On 9/24/12 4:30 PM, Brent Putman wrote:
>> You can obtain those service bean references via their Spring bean id's,
>> which are in turn exported to and so easily available from the
>> ServletContext (see the servlet context attribute exporter at the bottom
>> of service.xml).  
> 
> 
> I forgot that we actually have a more well-defined and official API for
> getting these service beans.  See:
> 
> edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper
> 
> methods getProfileHandlerManager, getRelyingPartyConfigurationManager,
> getAttributeResolver, getAttributeFilterEngine.
> 
> These are probably better to use than accessing the servlet context
> attributes directly, as the Spring bean id's (or how you use them) are
> in theory subject to change, but the helper methods guarantee a stable
> API to get at these services.
> 
> --Brent
> 
> --
> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20120926/355532f1/attachment.html