<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 6/8/17 11:59 AM, Cantor, Scott
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:9846A6064BD102419D06814DD0D78DE127F137FE@CIO-TNC-D2MBX02.osuad.osu.edu">
<blockquote type="cite">
<pre wrap="">Do you have a preferred way to add the: SAML 2.0 Assertion Extension
Schema <a class="moz-txt-link-rfc2396E" href="http://docs.oasis-open.org/xacml/2.0/access_control-xacml-2.0-saml-assertion-schema-os.xsd"><http://docs.oasis-open.org/xacml/2.0/access_control-xacml-2.0-
saml-assertion-schema-os.xsd></a> schema?
</pre>
</blockquote>
<pre wrap="">
The SchemaBuilder classes support adding extension schemas when you construct them. Since all I care about is Shibboleth, I'm not prepared to speak to specifics outside of doing it in the IdP with the Spring wiring, which you're not using.
</pre>
</blockquote>
<br>
In case the OP can read Spring wiring: What you essentially need to
do looks like the bean below [1], which hopefully you can translate
into equivalent Java code easily. Here we are adding in support for
a SAML metadata extension schema:<br>
<br>
<tt> <!-- Bean used by the SchemaValidation metadata filter
and anything else doing basic schema validation. --></tt><tt><br>
</tt><tt> <bean id="shibboleth.SchemaBuilder" lazy-init="true"</tt><tt><br>
</tt><tt>
class="org.opensaml.saml.common.xml.SAMLSchemaBuilder"
c:ver="SAML_11" ></tt><tt><br>
</tt><tt> <property name="schemaBuilder"></tt><tt><br>
</tt><tt> <bean
class="net.shibboleth.utilities.java.support.xml.SchemaBuilder"></tt><tt><br>
</tt><tt> <property name="resourceResolver"></tt><tt><br>
</tt><tt> <bean
class="net.shibboleth.utilities.java.support.xml.ClasspathResolver"
/></tt><tt><br>
</tt><tt> </property></tt><tt><br>
</tt><tt> <property name="schemaResources"></tt><tt><br>
</tt><tt> <list></tt><tt><br>
</tt><tt> <value>#{'classpath:' +
T(org.opensaml.saml.common.xml.SAMLConstants).XMLSIG_SCHEMA_LOCATION
}</value></tt><tt><br>
</tt><tt> <value>#{'classpath:' +
T(net.shibboleth.idp.saml.xmlobject.ExtensionsConstants).SHIB_MDEXT10_SCHEMA_LOCATION
}</value></tt><tt><br>
</tt><tt> </list></tt><tt><br>
</tt><tt> </property></tt><tt><br>
</tt><tt> </bean></tt><tt><br>
</tt><tt> </property></tt><tt><br>
</tt><tt> </bean></tt><br>
<br>
<br>
For reasons which have to do with inter-schema dependencies and the
way these classes are composed, we have to redundantly add the XML
Signature one before the extension one, even though it is already a
part of the set included by SAMLSchemaBuilder. <br>
<br>
That's because the extension one does an <import> of the
signature one. With all the XACML stuff, you may find that you have
to do similar things with schemas that are nominally already in the
SAMLSchemaBuilder, i.e. if they depend on it, you likely have to
explicitly include it in the SchemaBuilder instance you hand to
SAMLSchemaBuilder.<br>
<br>
Ultimately these are just convenience classes in our project. You
can produce a javax.xml.validation.Schema instance however you want,
without using our utility classes, and hand it to our
BasicParserPool. Maybe that's easier for you, I don't know.<br>
<br>
<br>
<br>
[1]
<a class="moz-txt-link-freetext" href="http://git.shibboleth.net/view/?p=java-identity-provider.git;a=blob;f=idp-conf/src/main/resources/system/conf/global-system.xml;hb=HEAD">http://git.shibboleth.net/view/?p=java-identity-provider.git;a=blob;f=idp-conf/src/main/resources/system/conf/global-system.xml;hb=HEAD</a><br>
<br>
</body>
</html>