Null Pointer Exception from UnmarshallerFactory while migrating from OpenSAML2.x to OpenSAML3.x

[Brent Putman]

On 8/7/19 6:50 PM, Brent Putman wrote:
>
>
> On 8/6/19 1:30 AM, DD K wrote:
>>
>> The exception is thrown from the code snippet at the commented line:
>>
>> public static XMLObject unmarshall(String authReqStr) throws IdentityException {
>>     InputStream inputStream = null; try {
>>         doBootstrap(); DocumentBuilderFactory documentBuilderFactory = IdentityUtil.getSecuredDocumentBuilderFactory(); DocumentBuilder docBuilder = documentBuilderFactory.newDocumentBuilder(); inputStream = new ByteArrayInputStream(authReqStr.trim().getBytes(StandardCharsets.UTF_8)); Document document = docBuilder.parse(inputStream); Element element = document.getDocumentElement(); UnmarshallerFactory unmarshallerFactory = XMLObjectProviderRegistrySupport.getUnmarshallerFactory(); Unmarshaller unmarshaller = unmarshallerFactory.getUnmarshaller(element);return unmarshaller.unmarshall(element); // Exception thrown here } catch (Exception e) {
>>         log.error("Error in constructing AuthRequest from the encoded String", e); throw IdentityException.error(
>>                 "Error in constructing AuthRequest from the encoded String ", e); } finally {
>>         if (inputStream != null) {
>>             try {
>>                 inputStream.close(); } catch (IOException e) {
>>                 log.error("Error while closing the stream", e); }
>>         }
>>     }
>> }
>>
>
>
> I don't see anything obviously wrong there.  If it's throwing on that
> line, it's likely that the unmarshaller is null, which means you
> didn't get anything back from the unmarshallerFactory.  That means
> something is likely not working with your initialization of the
> library.  I can't say anything more than that.  I'd suggest turning
> up logging to DEBUG or even TRACE on some or all of the OpenSAML
> packages to see what is actually happening, for example whether you
> are actually successfully reading and registering the XMLObject
> builders, marshallers and unmarshallers.
>

I doubt it's related to your NPE issue, but I meant to also say that
we'd in general strongly recommend using our ParserPool imp to parse
the InputStream into a Document.  It's safer and easier, and there's
also some mandatory things that you must now do when parsing with your
own JAXP or other XML components, or else unmarshalling will fail, period.

https://wiki.shibboleth.net/confluence/display/OS30/Secure+XML+Processing+Requirements

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20190807/ee397504/attachment.html>