OIDC XML Metadata Schema Location

[Cantor, Scott]

On 4/14/21, 11:12 AM, "users on behalf of Fuhr, Emily" <users-bounces at shibboleth.net on behalf of efuhr at austin.utexas.edu> wrote:

>    Now onto my question: In order to enforce validation against the OIDC XML metadata schema I need to set
> processContents="strict" for the Extensions element in the SAML schema and add an import for the OIDC XML
> schema. Is this the expected method for enforcing schema correctness here? Is there a better way to do so?

No, but it varies widely by tool. In practice the extensions have to be lax because otherwise nobody could ever deploy extensions. You can't require everybody to have every schema.

If your tool can't recognize extensions simply by preloading the schema in some way so that when it encounters content that is defined in the schema it can enforce the rules, the tool is limited, though if you want to work around it the way you did, of course that's your business.

But no, that's not a general requirement. Java's XML parser for example definitely can validate the extensions if the schema is loaded into the validator, and that's mainly because it's not required that it be done while parsing, it's an explicit "validate against these schemas" step.

I tested that our SchemaValidation filter for metadata works if you feed it OIDC content, and I extended the system's internals so that the OIDC plugin essentially "adds" the schema dynamically to the set rather than requiring people configure something by hand.

-- Scott