Custom DataConnector failing when upgrading to Shibboleth IDP 5.x

[Dave Rager]

We are attempting to upgrade from Shibboleth IDP 4.x to the latest 5.x. We have a custom DataConnector for resolving attributes from a Mongo database. While this DataConnector has been working fine on 4.x, after upgrading to 5.x we run into the following error:

WARN [net.shibboleth.shared.spring.custom.LocalOnlyResourceEntityResolver:54 - Blocking attempted remote resolution of [classpath:/schema/mongodb-connector.xsd]
ERROR [net.shibboleth.shared.service.AbstractReloadableService:179] - Service 'shibboleth.AttributeRegistryService': Initial load failed
net.shibboleth.shared.service.ServiceException: org.springframework.beans.factory.BeanDefinitionStoreException: Blocked atttempted remote resolution
    at net.shibboleth.shared.spring.service.ReloadableSpringService.doReload(ReloadableSpringService.java:375)
Caused by: org.springframework.beans.factory.BeanDefinitionStoreException: Blocked atttempted remote resolution
    at net.shibboleth.shared.spring.custom.LocalOnlyResourceEntityResolver.resolveSchemaEntity(LocalOnlyResourceEntityResolver.java:57)

After some investigation I ran across the following discussion: https://github.com/spring-projects/spring-framework/issues/29662

While I understand the need for this change I'm not sure why it is rejecting my schema that is on the classspath.

In ResourceEntityResolver.java method public InputSource resolveEntity(@Nullable String publicId, @Nullable String systemId), the check looks at the suffix and not the protocol, before dropping to LocalOnlyResourceEntityresolver:

        else if (systemId.endsWith(DTD_SUFFIX) || systemId.endsWith(XSD_SUFFIX)) {
            source = resolveSchemaEntity(publicId, systemId);
        }

In the debugger the systemId is indeed: classpath:/schema/mongodb-connector.xsd

Previously in that same method, it tries to match the systemId with systemRootUrl which ends up being 'file:/<path>/<to>/<tomcat>'

        String givenUrl = ResourceUtils.toURL(decodedSystemId).toString();
        String systemRootUrl = new File("").toURI().toURL().toString();
        // Try relative to resource base if currently in system root.
        if (givenUrl.startsWith(systemRootUrl)) {
            resourcePath = givenUrl.substring(systemRootUrl.length());
        }

I'm not sure why it's not trying to resolve the file on the classpath.

Double checking the latest docs here: https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199512485/Developing+Attribute+Resolver+Extensions#Data-Connectors Everything still looks correct.

The schema is located on the classpath in schema/mongodb-connector.xsd

My spring.schemas file looks like this:

http\://dev.unitedid.org/NS/mongodb-connector/mongodb-connector.xsd=schema/mongodb-connector.xsd

My spring.handlers file looks like this:

http\://dev.unitedid.org/NS/mongodb-connector=org.unitedid.shibboleth.config.attribute.resolver.dataConnector.UIDDataConnectorNamespaceHandler

I'm not sure at this point if the problem is in Spring 6.x or Shibboleth 5. Or is there another configuration change that is necessary to get custom DataConnectors to function with a custom schema? Or should I investigate an alternate approach and abandon this old code?

Thanks,
Dave.