Verification of SAML Schema

[Brent Putman]

On 6/8/17 11:59 AM, Cantor, Scott wrote:
>> Do you have a preferred way to add the: SAML 2.0 Assertion Extension
>> Schema <http://docs.oasis-open.org/xacml/2.0/access_control-xacml-2.0-
>> saml-assertion-schema-os.xsd>  schema?
> The SchemaBuilder classes support adding extension schemas when you construct them. Since all I care about is Shibboleth, I'm not prepared to speak to specifics outside of doing it in the IdP with the Spring wiring, which you're not using.

In case the OP can read Spring wiring: What you essentially need to do
looks like the bean below [1], which hopefully you can translate into
equivalent Java code easily. Here we are adding in support for a SAML
metadata extension schema:

    <!--  Bean used by the SchemaValidation metadata filter and
anything else doing basic schema validation. -->
    <bean id="shibboleth.SchemaBuilder" lazy-init="true"
        class="org.opensaml.saml.common.xml.SAMLSchemaBuilder"
c:ver="SAML_11" >
        <property name="schemaBuilder">
            <bean
class="net.shibboleth.utilities.java.support.xml.SchemaBuilder">
                <property name="resourceResolver">
                    <bean
class="net.shibboleth.utilities.java.support.xml.ClasspathResolver" />
                </property>
                <property name="schemaResources">
                    <list>
                        <value>#{'classpath:' +
T(org.opensaml.saml.common.xml.SAMLConstants).XMLSIG_SCHEMA_LOCATION
}</value>
                        <value>#{'classpath:' +
T(net.shibboleth.idp.saml.xmlobject.ExtensionsConstants).SHIB_MDEXT10_SCHEMA_LOCATION
}</value>
                    </list>
                </property>
            </bean>
        </property>
    </bean>


For reasons which have to do with inter-schema dependencies and the way
these classes are composed, we have to redundantly add the XML
Signature one before the extension one, even though it is already a
part of the set included by SAMLSchemaBuilder.

That's because the extension one does an <import> of the signature
one.  With all the XACML stuff, you may find that you have to do
similar things with schemas that are nominally already in the
SAMLSchemaBuilder, i.e. if they depend on it, you likely have to
explicitly include it in the SchemaBuilder instance you hand to
SAMLSchemaBuilder.

Ultimately these are just convenience classes in our project.  You can
produce a javax.xml.validation.Schema instance however you want,
without using our utility classes, and hand it to our BasicParserPool. 
Maybe that's easier for you, I don't know.



[1]
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=blob;f=idp-conf/src/main/resources/system/conf/global-system.xml;hb=HEAD

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20170609/a3d50a5a/attachment.html>