Issue with xmltooling and attribute namespace

[Brent Putman]

On 2/25/14 9:13 AM, Massimiliano Masi wrote:
> Hi All, 
>
>
>
> In project A, my XMLObject is unmarshalled as:

My question would be: Unmarshalled from where?  Coming in over the wire
from a WS service or WS client of some kind (e.g. see below re: Apache
Axis).  OpenSAML doesn't change a DOM when it unmarshalls an XMLObject
tree around it, so my guess would be that the XML already looks that way
before it gets to your OpenSAML.  Or else, it's being mutated in some
way by whatever DOM serialization you are applying.  But either way I
don't think OpenSAML is directly involved.

If you're pulling this off the wire, I'd try serializing and logging it
before you hand it to OpenSAML for unmarshalling, just to confirm
exactly what you are receiving.

>
>
> Project A is good, since it declares a namespace for the attributes
> DataType and Name, while in project B such attribtues are not set.
> This violates this schema definition: 
>
>   <xs:elementname="ClaimType"type="ts:ClaimTypeType"/>
>
>     <xs:complexTypename="ClaimTypeType">
>
>         <xs:attributename="DataType"type="xs:anyURI"use="required"  />
>
>         <xs:attributename="name"type="xs:anyURI"use="required"/>
>
>     </xs:complexType>
>
>


Actually, that's not really clear just from that schema snippet. 
Whether the attributes in an instance document are namespace-qualified
or not depends (in part) on the <xs:schema> element's  '
attributeFormDefault' attribute. If it's absent, it defaults to
'unqualified'.  Unless the schema is explicitly setting
'attributeFormDefault=qualified', then based on that schema snippet, I
believe the unqualified forms in your B example would be the correct
schema-valid ones.   See also ' elementFormDefault' , which does the
same for elements.

Note that a lot of schemas, including SAML and WS-Trust, set (and/or
effectively default) 'elementFormDefault=qualified' and
'attributeFormDefault=unqualified', meaning elements will be
namespace-qualified, but attributes are not.

(That doesn't really have anything to do with why you're seeing 2
different outputs, though).



>
> Since the code (from project A) is the same, it must be a problem of
> libraries. Do you have suggestions?

Not specifically, but that ns0, ns1, etc stuff looks suspiciously like
what Apache Axis does when it generates Java code to handle a particular
schema (the "contract driven" way).  So perhaps that is relevant
somewhere in what you are doing, or at least you are somehow using some
of the same libraries that they do.


--Brent


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20140225/63edad00/attachment.html