Can't use xacml3 inside RequestType in XACMLAuthzDecisionQueryType

[alessio lunardelli]

Hi everybody,
I'm becoming mad in the last 2 days about using/sending xacml3
over XACMLAuthzDecisionQueryType in opensaml 3.2.0.

The problem it's quite easy to explain. You need to attach a requestType
to XACMLAuthzDecisionQueryType, and inside RequestType you CAN use xacml3,
according to standard.
BUT
RequestType of opensaml appear to hate xacml3 and expect just old
"subject,action,blabla".
So i tryed (well i tryed 20434 things, but last)
Create a well formed xacml3 request context

<xacml-context:Request
xmlns:xacml-context="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"
CombinedDecision="false" ReturnPolicyIdList="false">
  <xacml-context:Attributes
Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"
xmlns:xacml-context="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17">
    <xacml-context:Attribute
AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id"
IncludeInResult="true"
xmlns:xacml-context="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17">
      <xacml-context:AttributeValue DataType="
http://www.w3.org/2001/XMLSchema#string"
xmlns:xacml-context="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17">requester</xacml-context:AttributeValue>
    </xacml-context:Attribute>
  </xacml-context:Attributes>
</xacml-context:Request>

It's perfect for standard
http://docs.oasis-open.org/xacml/xacml-saml-profile/v2.0/xacml-saml-profile-v2.0.pdf
and it's valid against schema, xacml3 has just attributes.

But if i try to
Element s = XMLHelper.stringToElement(j); //s is just the above xml
converted to w3c element.
Unmarshaller af=unmarFactory.getUnmarshaller(s); //this fail in exception
RequestType rt=(RequestType)af.unmarshall(s);

19:56:45.422 [main] ERROR j.osaml3Utils -
net.shibboleth.utilities.java.support.logic.ConstraintViolationException:
Local name cannot be null or empty
at
net.shibboleth.utilities.java.support.logic.Constraint.isNotNull(Constraint.java:227)
at
net.shibboleth.utilities.java.support.xml.QNameSupport.constructQName(QNameSupport.java:79)
at
net.shibboleth.utilities.java.support.xml.QNameSupport.getNodeQName(QNameSupport.java:102)
at
org.opensaml.core.xml.io.UnmarshallerFactory.getUnmarshaller(UnmarshallerFactory.java:86)
at
javaapplicationtestopensaml3.osaml3Utils.testXamlRequestType(osaml3Utils.java:72)
at
javaapplicationtestopensaml3.JavaApplicationtestOpensaml3.main(JavaApplicationtestOpensaml3.java:25)

If i can't unmarshall that to RequestType i can't use .setRequest for
XACMLAuthzDecisionQueryType. And i cant marshall everything to send at PDP.

If you don't know how to fix thats, someone know at least how to work
around that? I really need soon to use saml for query with xacml3.

Thanks in advice.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150707/2900772a/attachment.html>