Verification of SAML Schema

[Massimiliano Masi]

Hi All, 

I’ve a problem validating SAML assertion containing a XACML statement. 

I initialize my validation class as: 
 /**
     * This is the initalization of the {@link #validateCoreSchema(SAMLObject)}. 
     * Since opensaml 3.3, the interface no longer exist, and the schema validation
     * takes time. 
     */
    static {
        SAMLSchemaBuilder ssb = new SAMLSchemaBuilder(SAML1Version.SAML_11);
        
        Schema schema;
        try {
            schema = ssb.getSAMLSchema();
        } catch (SAXException e) {
            throw new RuntimeException(e);
        }
        val = schema.newValidator();
    }


and I validate it as: 

    /**
     * Given a SAMLObject, this method validates the schema. The schema is the
     * SAML Core
     * @param a
     *            The SAMLObject to be validated
     * @throws ValidationException
     *             If the object is not valid
     * @throws SAXException
     * @throws com.spirit.saml.ValidationException
     */
    public static void validateCoreSchema(final SAMLObject a) throws com.spirit.saml.ValidationException {

        try {
            
            Element el = toElement(a);
            val.validate(new DOMSource(el));
        } catch (IOException | GeneralSAMLException | SAXException e) {
            e.printStackTrace();
            throw new com.spirit.saml.ValidationException("SAML Assertion failed schema check: " + e.getMessage(), e);
        }
    

However when I have the following assertion: 

                </saml2:AttributeStatement>
                <saml2:Statement xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xacml-saml:XACMLPolicyStatementType">
                    <PolicySet xmlns="urn:oasis:names:tc:xacml:2.0:policy:schema:os" PolicyCombiningAlgId="urn:oasis:names:tc:xacml:1.0:policy-combining-algorithm:permit-overrides" PolicySetId="polfake" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:oasis:names:tc:xacml:2.0:policy:schema:os http://docs.oasis-open.org/xacml/access_control-xacml-2.0-policy-schema-os.xsd">
    <Description>FAKES</Description>
    <Target/>
    <Policy PolicyId="policy_id_poldeny" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:permit-overrides" xmlns="urn:oasis:names:tc:xacml:2.0:policy:schema:os">
        <Description>Policy that fakes everything</Description>
        <Target/>
        <Rule Effect="Deny" RuleId="urn:oasis:names:tc:xacml:2.0:example:SimpleRule1"/>
        
    </Policy>
</PolicySet>
                </saml2:Statement>
            </saml2:Assertion>

Of course it returns: 

Caused by: org.xml.sax.SAXParseException; cvc-elt.4.2: Cannot resolve 'xacml-saml:XACMLPolicyStatementType' to a type definition for element 'saml2:Statement'.
	at org.apache.xerces.util.ErrorHandlerWrapper.createSAXParseException(Unknown Source)
	at org.apache.xerces.util.ErrorHandlerWrapper.error(Unknown Source)
	at org.apache.xerces.impl.XMLErrorReporter.reportError(Unknown Source)
	at org.apache.xerces.impl.XMLErrorReporter.reportError(Unknown Source)
	at org.apache.xerces.impl.XMLErrorReporter.reportError(Unknown Source)
	at org.apache.xerces.impl.xs.XMLSchemaValidator$XSIErrorReporter.reportError(Unknown Source)
	at org.apache.xerces.impl.xs.XMLSchemaValidator.reportSchemaError(Unknown Source)
	at org.apache.xerces.impl.xs.XMLSchemaValidator.getAndCheckXsiType(Unknown Source)
	at org.apache.xerces.impl.xs.XMLSchemaValidator.handleStartElement(Unknown Source)
	at org.apache.xerces.impl.xs.XMLSchemaValidator.startElement(Unknown Source)
	at org.apache.xerces.jaxp.validation.DOMValidatorHelper.beginNode(Unknown Source)
	at org.apache.xerces.jaxp.validation.DOMValidatorHelper.validate(Unknown Source)
	at org.apache.xerces.jaxp.validation.DOMValidatorHelper.validate(Unknown Source)
	at org.apache.xerces.jaxp.validation.ValidatorImpl.validate(Unknown Source)
	at javax.xml.validation.Validator.validate(Validator.java:124)

Do you have a preferred way to add the: SAML 2.0 Assertion Extension Schema <http://docs.oasis-open.org/xacml/2.0/access_control-xacml-2.0-saml-assertion-schema-os.xsd> schema?


Thanks, 

	Massimiliano


--
Anger is a gift, http://www.mascanc.net/

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20170608/3159ed87/attachment.html>