using XML entities to ease adminstration, many SP:s using the same shibboleth2.xml files

[Palle Girgensohn]

Hi,

I'm using some simple XML entitites to make configuration and change management more feasible through some dozen SP configurations that are very similar.

At the start of shibboleth2.xml, I expected to be able to add:

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE SPConfig [
	<!ENTITY % environment SYSTEM "entity-definitions.dtd">
	%environment;
]>



and the entity-definitions.dtd would look like

<!ENTITY sp "https://localhost/Shibboleth.sso/Metadata">


for example..


Later in shibboleth2.xml:

...
	<ApplicationDefaults entityID="&sp;"
...


The gain is obvious if you have many very similar setups. Just put your SP entityID (and other parameters) in the entity-definitions.dtd and voila. The rest of the config is maintained in one single static source file. Changes in the single shibboleth2.xml are reflected for alls SP:s. No automatic or manual rewrites needed. All local setup if maintained separately in the entity-definitions.dtd file.

Now, the above is accepted by normal XML tools and validators, but shibboleth does something different. xmltoolings just is not OK with the above. The log says: 

ERROR XMLTooling.ParserPool : fatal error on line 2, column 21, message: internal subset is not allowed when reusing the grammar
ERROR Shibboleth.Config : error while loading resource (/usr/local/etc/shibboleth/shibboleth2.xml): XML error(s) during parsing, check log for specifics
FATAL Shibboleth.Config : caught exception while loading configuration: XML error(s) during parsing, check log for specifics



Shibboleth accepts the setup if I change the DOCTYPE, lying that the actual root SPConfig is defined in the entity-definitions.dtd:

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE SPConfig SYSTEM "entity-definitions.dtd">


Shibboleth has no problems eating this, and everything is working... except that now, editors and other tools scream with errors, "Element SPConfig must declared". It isn't declared, I'm aware of that, but this is the only way I've managed to shibboleth to do what I want.

Question is, what is special about shibboleth's xml parser, why does it not accept the normal XML DOCTYPE voodoo, but accepts a buggy setup? Is the shibboleth2.xml included into another file somehow?  "internal subset is not allowed when reusing the grammar"?

While I can live with red editors and happy shibd, I'd love to make both tools happy. Any ideas?

Palle



-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 495 bytes
Desc: Message signed with OpenPGP using GPGMail
Url : http://shibboleth.net/pipermail/users/attachments/20140227/c920151d/attachment.bin