Ex: Re: OIDC InvalidRedirectionURI

[Paul B. Henson]

> From: Cantor, Scott
> Sent: Thursday, November 9, 2023 12:49 PM
> 
> That's how wildcards in schemas work, generally. You get lax validation on
> unknown content.

Ah. I fear I was not intimately familiar with XML validators, thanks for the clarification.

> I doubt that sort of classpath syntax will work, but regardless if it's not
> checking it, it didn't load the schema.

That's what the documentation (https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631653/SchemaValidationFilter) says to do? "should be classpath-based resources for the parser to resolve them properly", with the example:

<bean id="shibboleth.ExtensionSchemas" parent="shibboleth.DefaultExtensionSchemas">
        <property name="sourceList">
            <list merge="true">
                <value>classpath:/schema/custom-schema.xsd</value>
            </list>
        </property>
    </bean>

I verified the xsd was in the classpath:

/opt/shibboleth-idp/dist/plugin-webapp/WEB-INF/lib/oidc-common-saml-api-2.2.1.jar
     3937  06-13-2023 14:13   schema/saml-metadata-ext-oidcmd.xsd

If this isn't the right way to refer to it, what would be?

<value>classpath:/schema/saml-metadata-ext-oidcmd.xsd</value>

It appears to be finding it; if I change the schema value to something that doesn't exist, it generates an error at startup:

2023-11-09 15:00:20,355 - / - ERROR [net.shibboleth.utilities.java.support.xml.SchemaBuilder:279] - IO error a
dding schema from resource: class path resource [schema/not-saml-metadata-ext-oidcmd.xsd]
java.io.FileNotFoundException: class path resource [schema/not-saml-metadata-ext-oidcmd.xsd] cannot be opened 
because it does not exist

There is no such error with my original configuration with the schema file contained in the jar.

> The point of schema validation is generally to check remote content. When
> you control it, it's more about using decent editors that will do it for you if
> you give them the schemas.

Ehh. I'm not the only person that will necessarily be adding metadata to the idp, and I'm probably not going to get all of them to set up schema validation in their editors. I guess I could set up something in our configuration management deployment mechanism to run xmllint on it.

Thanks…