<div dir="ltr">Hi everybody,<div>I'm becoming mad in the last 2 days about using/sending xacml3 over XACMLAuthzDecisionQueryType in opensaml 3.2.0.</div><div><br></div><div>The problem it's quite easy to explain. You need to attach a requestType to XACMLAuthzDecisionQueryType, and inside RequestType you CAN use xacml3, according to standard.</div><div>BUT</div><div>RequestType of opensaml appear to hate xacml3 and expect just old "subject,action,blabla".</div><div>So i tryed (well i tryed 20434 things, but last)</div><div>Create a well formed xacml3 request context</div><div><br></div><div><div><xacml-context:Request xmlns:xacml-context="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" CombinedDecision="false" ReturnPolicyIdList="false"></div><div>  <xacml-context:Attributes Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" xmlns:xacml-context="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"></div><div>    <xacml-context:Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id" IncludeInResult="true" xmlns:xacml-context="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"></div><div>      <xacml-context:AttributeValue DataType="<a href="http://www.w3.org/2001/XMLSchema#string">http://www.w3.org/2001/XMLSchema#string</a>" xmlns:xacml-context="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17">requester</xacml-context:AttributeValue></div><div>    </xacml-context:Attribute></div><div>  </xacml-context:Attributes></div><div></xacml-context:Request></div></div><div><br></div><div>It's perfect for standard <a href="http://docs.oasis-open.org/xacml/xacml-saml-profile/v2.0/xacml-saml-profile-v2.0.pdf">http://docs.oasis-open.org/xacml/xacml-saml-profile/v2.0/xacml-saml-profile-v2.0.pdf</a> and it's valid against schema, xacml3 has just attributes.</div><div><br></div><div>But if i try to </div><div><div>Element s = XMLHelper.stringToElement(j); //s is just the above xml converted to w3c element.</div><div>Unmarshaller af=unmarFactory.getUnmarshaller(s); //this fail in exception</div><div>RequestType rt=(RequestType)af.unmarshall(s);</div></div><div><br></div><div><div>19:56:45.422 [main] ERROR j.osaml3Utils - net.shibboleth.utilities.java.support.logic.ConstraintViolationException: Local name cannot be null or empty</div><div><span class="" style="white-space:pre">        </span>at net.shibboleth.utilities.java.support.logic.Constraint.isNotNull(Constraint.java:227)</div><div><span class="" style="white-space:pre">   </span>at net.shibboleth.utilities.java.support.xml.QNameSupport.constructQName(QNameSupport.java:79)</div><div><span class="" style="white-space:pre">     </span>at net.shibboleth.utilities.java.support.xml.QNameSupport.getNodeQName(QNameSupport.java:102)</div><div><span class="" style="white-space:pre">      </span>at org.opensaml.core.xml.io.UnmarshallerFactory.getUnmarshaller(UnmarshallerFactory.java:86)</div><div><span class="" style="white-space:pre">       </span>at javaapplicationtestopensaml3.osaml3Utils.testXamlRequestType(osaml3Utils.java:72)</div><div><span class="" style="white-space:pre">       </span>at javaapplicationtestopensaml3.JavaApplicationtestOpensaml3.main(JavaApplicationtestOpensaml3.java:25)</div></div><div><br></div><div>If i can't unmarshall that to RequestType i can't use .setRequest for XACMLAuthzDecisionQueryType. And i cant marshall everything to send at PDP.</div><div><br></div><div>If you don't know how to fix thats, someone know at least how to work around that? I really need soon to use saml for query with xacml3.</div><div><br></div><div>Thanks in advice.<br> </div></div>