<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Hi All, <div class=""><br class=""></div><div class="">I’ve a problem validating SAML assertion containing a XACML statement. </div><div class=""><br class=""></div><div class="">I initialize my validation class as: </div><div class=""><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; color: rgb(79, 118, 203);" class=""><span style="color: #000000" class=""> </span>/**</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; color: rgb(79, 118, 203);" class=""> * This is the <span style="text-decoration: underline" class="">initalization</span> of the <span style="color: #5158cb" class="">{@link #validateCoreSchema(SAMLObject)}</span>. </div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; color: rgb(79, 118, 203);" class=""> * Since <span style="text-decoration: underline" class="">opensaml</span> 3.3, the interface no longer exist, and the schema validation</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; color: rgb(79, 118, 203);" class=""> * takes time. </div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; color: rgb(79, 118, 203);" class=""> */</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;" class=""> <span style="color: #931a68" class="">static</span> {</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;" class=""> SAMLSchemaBuilder <span style="color: #7e504f" class="">ssb</span> = <span style="color: #931a68" class="">new</span> SAMLSchemaBuilder(SAML1Version.<span style="color: #0326cc" class="">SAML_11</span>);</div><p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; min-height: 15px;" class=""> <br class="webkit-block-placeholder"></p><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;" class=""> Schema <span style="color: #7e504f" class="">schema</span>;</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;" class=""> <span style="color: #931a68" class="">try</span> {</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;" class=""> <span style="color: #7e504f" class="">schema</span> = <span style="color: #7e504f" class="">ssb</span>.getSAMLSchema();</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;" class=""> } <span style="color: #931a68" class="">catch</span> (SAXException <span style="color: #7e504f" class="">e</span>) {</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;" class=""> <span style="color: #931a68" class="">throw</span> <span style="color: #931a68" class="">new</span> RuntimeException(<span style="color: #7e504f" class="">e</span>);</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;" class=""> }</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;" class=""> <span style="color: #0326cc" class="">val</span> = <span style="color: #7e504f" class="">schema</span>.newValidator();</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;" class=""> }</div></div><div class=""><div><br class=""></div><div><br class=""></div><div>and I validate it as: </div><div><br class=""></div><div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;" class=""> <span style="color: #4f76cb" class="">/**</span></div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; color: rgb(79, 118, 203);" class=""> * Given a SAMLObject, this method validates the schema. The schema is the</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; color: rgb(79, 118, 203);" class=""> * SAML Core</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; color: rgb(79, 118, 203);" class=""> * <span style="color: #91afcb" class="">@param</span> a</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; color: rgb(79, 118, 203);" class=""> * The SAMLObject to be validated</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; color: rgb(79, 118, 203);" class=""> * <span style="color: #91afcb" class="">@throws</span> ValidationException</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; color: rgb(79, 118, 203);" class=""> * If the object is not valid</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; color: rgb(79, 118, 203);" class=""> * <span style="color: #91afcb" class="">@throws</span> SAXException</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; color: rgb(79, 118, 203);" class=""> * <span style="color: #91afcb" class="">@throws</span> com.spirit.saml.ValidationException</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; color: rgb(79, 118, 203);" class=""> */</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;" class=""> <span style="color: #931a68" class="">public</span> <span style="color: #931a68" class="">static</span> <span style="color: #931a68" class="">void</span> validateCoreSchema(<span style="color: #931a68" class="">final</span> SAMLObject <span style="color: #7e504f" class="">a</span>) <span style="color: #931a68" class="">throws</span> com.spirit.saml.ValidationException {</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; min-height: 15px;" class=""><br class=""></div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;" class=""> <span style="color: #931a68" class="">try</span> {</div><p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; min-height: 15px;" class=""> <br class="webkit-block-placeholder"></p><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;" class=""> Element <span style="color: #7e504f" class="">el</span> = toElement(<span style="color: #7e504f" class="">a</span>);</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;" class=""> <span style="color: #0326cc" class="">val</span>.validate(<span style="color: #931a68" class="">new</span> DOMSource(<span style="color: #7e504f" class="">el</span>));</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;" class=""> } <span style="color: #931a68" class="">catch</span> (IOException | GeneralSAMLException | SAXException <span style="color: #7e504f" class="">e</span>) {</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;" class=""> <span style="color: #7e504f" class="">e</span>.printStackTrace();</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;" class=""> <span style="color: #931a68" class="">throw</span> <span style="color: #931a68" class="">new</span> com.spirit.saml.ValidationException(<span style="color: #3933ff" class="">"SAML Assertion failed schema check: "</span> + <span style="color: #7e504f" class="">e</span>.getMessage(), <span style="color: #7e504f" class="">e</span>);</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;" class=""> }</div><p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; min-height: 15px;" class=""> <br class="webkit-block-placeholder"></p><div><br class=""></div>However when I have the following assertion: </div><div><br class=""></div><div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;" class=""> </saml2:AttributeStatement></div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;" class=""> <saml2:Statement xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance" class="">http://www.w3.org/2001/XMLSchema-instance</a>" xsi:type="xacml-saml:XACMLPolicyStatementType"></div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;" class=""> <PolicySet xmlns="urn:oasis:names:tc:xacml:2.0:policy:schema:os" PolicyCombiningAlgId="urn:oasis:names:tc:xacml:1.0:policy-combining-algorithm:permit-overrides" PolicySetId="polfake" xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance" class="">http://www.w3.org/2001/XMLSchema-instance</a>" xsi:schemaLocation="urn:oasis:names:tc:xacml:2.0:policy:schema:os <a href="http://docs.oasis-open.org/xacml/access_control-xacml-2.0-policy-schema-os.xsd" class="">http://docs.oasis-open.org/xacml/access_control-xacml-2.0-policy-schema-os.xsd</a>"></div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;" class=""> <Description>FAKES</Description></div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;" class=""> <Target/></div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;" class=""> <Policy PolicyId="policy_id_poldeny" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:permit-overrides" xmlns="urn:oasis:names:tc:xacml:2.0:policy:schema:os"></div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;" class=""> <Description>Policy that fakes everything</Description></div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;" class=""> <Target/></div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;" class=""> <Rule Effect="Deny" RuleId="urn:oasis:names:tc:xacml:2.0:example:SimpleRule1"/></div><p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; min-height: 15px;" class=""> <br class="webkit-block-placeholder"></p><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;" class=""> </Policy></div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;" class=""></PolicySet></div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;" class=""> </saml2:Statement></div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;" class=""> </saml2:Assertion></div><div><br class=""></div>Of course it returns: </div><div><br class=""></div><div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; color: rgb(255, 38, 0);" class="">Caused by: org.xml.sax.SAXParseException; cvc-elt.4.2: Cannot resolve 'xacml-saml:XACMLPolicyStatementType' to a type definition for element 'saml2:Statement'.</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; color: rgb(255, 38, 0);" class=""><span class="Apple-tab-span" style="white-space:pre"> </span>at org.apache.xerces.util.ErrorHandlerWrapper.createSAXParseException(Unknown Source)</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; color: rgb(255, 38, 0);" class=""><span class="Apple-tab-span" style="white-space:pre"> </span>at org.apache.xerces.util.ErrorHandlerWrapper.error(Unknown Source)</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; color: rgb(255, 38, 0);" class=""><span class="Apple-tab-span" style="white-space:pre"> </span>at org.apache.xerces.impl.XMLErrorReporter.reportError(Unknown Source)</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; color: rgb(255, 38, 0);" class=""><span class="Apple-tab-span" style="white-space:pre"> </span>at org.apache.xerces.impl.XMLErrorReporter.reportError(Unknown Source)</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; color: rgb(255, 38, 0);" class=""><span class="Apple-tab-span" style="white-space:pre"> </span>at org.apache.xerces.impl.XMLErrorReporter.reportError(Unknown Source)</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; color: rgb(255, 38, 0);" class=""><span class="Apple-tab-span" style="white-space:pre"> </span>at org.apache.xerces.impl.xs.XMLSchemaValidator$XSIErrorReporter.reportError(Unknown Source)</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; color: rgb(255, 38, 0);" class=""><span class="Apple-tab-span" style="white-space:pre"> </span>at org.apache.xerces.impl.xs.XMLSchemaValidator.reportSchemaError(Unknown Source)</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; color: rgb(255, 38, 0);" class=""><span class="Apple-tab-span" style="white-space:pre"> </span>at org.apache.xerces.impl.xs.XMLSchemaValidator.getAndCheckXsiType(Unknown Source)</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; color: rgb(255, 38, 0);" class=""><span class="Apple-tab-span" style="white-space:pre"> </span>at org.apache.xerces.impl.xs.XMLSchemaValidator.handleStartElement(Unknown Source)</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; color: rgb(255, 38, 0);" class=""><span class="Apple-tab-span" style="white-space:pre"> </span>at org.apache.xerces.impl.xs.XMLSchemaValidator.startElement(Unknown Source)</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; color: rgb(255, 38, 0);" class=""><span class="Apple-tab-span" style="white-space:pre"> </span>at org.apache.xerces.jaxp.validation.DOMValidatorHelper.beginNode(Unknown Source)</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; color: rgb(255, 38, 0);" class=""><span class="Apple-tab-span" style="white-space:pre"> </span>at org.apache.xerces.jaxp.validation.DOMValidatorHelper.validate(Unknown Source)</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; color: rgb(255, 38, 0);" class=""><span class="Apple-tab-span" style="white-space:pre"> </span>at org.apache.xerces.jaxp.validation.DOMValidatorHelper.validate(Unknown Source)</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; color: rgb(255, 38, 0);" class=""><span class="Apple-tab-span" style="white-space:pre"> </span>at org.apache.xerces.jaxp.validation.ValidatorImpl.validate(Unknown Source)</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; color: rgb(255, 38, 0);" class=""><span class="Apple-tab-span" style="white-space:pre"> </span>at javax.xml.validation.Validator.validate(<span style="text-decoration: underline ; color: #0080e1" class="">Validator.java:124</span>)</div><div><br class=""></div>Do you have a preferred way to add the: <a href="http://docs.oasis-open.org/xacml/2.0/access_control-xacml-2.0-saml-assertion-schema-os.xsd" class="">SAML 2.0
Assertion Extension Schema</a> schema?</div><div><br class=""></div><div><br class=""></div><div>Thanks, </div><div><br class=""></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Massimiliano</div><div><br class=""></div><br class=""><div class="">
--<br class="">Anger is a gift, <a href="http://www.mascanc.net/" class="">http://www.mascanc.net/</a>
</div>
<br class=""></div></body></html>