Ex: Re: metadata SchemaValidationFilter for OIDC metadata

[Paul B. Henson]

On Wed, Nov 08, 2023 at 04:29:02AM +0000, Cantor, Scott via users wrote:

> That kinda looks like it's missing the namespace prefix, like you
> jammed it in without the colon? Not sure. It seems to think your
> extension is in the SAML namespace.

Ah, yep, that's the hint I needed; I'd missed the oidcmd prefix and just
had '<oidcOAuthRPExtensions' instead of '<oidcmd:oidcOAuthRPExtensions'.
After I added it the filter worked fine. I went and checked, and the
wiki example I was working from did have it, so it seems I dropped it in
a cut-n-paste operation <sigh>.

> I don't know. I don't think that's the entirety of the problem, but I
> don't know if the plugin actually does supply the schema or if it's

Barring user oopsies looks like schema validation for oidc metadata
works fine, thanks...

Another quickie on the subject, I've got everything running (but not yet
tested) with just one warning popping up:

2023-11-07 20:42:58,805 - / - WARN
[net.shibboleth.oidc.metadata.cache.impl.DefaultFileLoadingStrategy:63]
- File resource is null, no bytes will be returned


Poking at the code, I see in oidc-common in
MetadataPolicyLookupStrategyFactory.java:

Resource fileResource = null;
        if (resource != null && !resource.isEmpty()) {
            final ResourceLoader resourceLoader = new PreferFileSystemResourceLoader();
            fileResource = resourceLoader.getResource(resource);
        }

        final DefaultFileLoadingStrategy fileStrategy = new DefaultFileLoadingStrategy(fileResource);


if there's no resource passed in, it creates the object with a null
fileResource, which causes the warning in DefaultFileLoadingStrategy.java:

       if (metadata == null) {
           log.warn("File resource is null, no bytes will be returned");


The oidc plugin in

src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml 

appears to create a bean without passing a file resource:

    <bean id="shibboleth.oidc.dynreg.MetadataPolicyLookupStrategyFactory"
        class="net.shibboleth.oidc.metadata.cache.impl.MetadataPolicyLookupStrategyFactory" />


So unless I'm missing something the oidc plugin will always generate this
warning and there's no way to make it not?

I can just tune my log reports to ignore it, but philosophically it will
annoy me to have a warning for an expected and intentional use case :).

Thanks much...


-- 
Paul B. Henson  |  (909) 979-6361  |  http://www.cpp.edu/~henson/
Operating Systems and Network Analyst  |  henson at cpp.edu
California State Polytechnic University  |  Pomona CA 91768