為什么此XML驗證在擴展型別的NameIDFormat上失敗？-有解無憂

我最近遇到了來自客戶的 SAML 元資料驗證問題。

元資料的相關部分失敗：

<IDPSSODescriptor protocolSupportEnumeration="urn:mace:shibboleth:1.0 urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:2.0:protocol">

  <Extensions>
    <shibmd:Scope regexp="false">...</shibmd:Scope>
  </Extensions>

  <KeyDescriptor>
    <ds:KeyInfo>
      <ds:X509Data>
        <ds:X509Certificate>
        ...
        </ds:X509Certificate>
      </ds:X509Data>
    </ds:KeyInfo>
  </KeyDescriptor>
    
  <ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding" Location="..." index="1"/>
  <ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="..." index="2"/>

  <SingleSignOnService Binding="urn:mace:shibboleth:1.0:profiles:AuthnRequest" Location="..."/>
  <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="..."/>
  <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="..."/>
  <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="h..."/>
    
  <NameIDFormat>urn:mace:shibboleth:1.0:nameIdentifier</NameIDFormat>
  <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>
</IDPSSODescriptor>

這失敗并出現以下錯誤： cvc-complex-type.2.4.a: Invalid content was found starting with element 'NameIDFormat'. One of '{"urn:oasis:names:tc:SAML:2.0:metadata":SingleSignOnService, "urn:oasis:names:tc:SAML:2.0:metadata":NameIDMappingService, "urn:oasis:names:tc:SAML:2.0:metadata":AssertionIDRequestService, "urn:oasis:names:tc:SAML:2.0:metadata":AttributeProfile, "urn:oasis:names:tc:SAML:2.0:assertion":Attribute}' is expected.

以下是的相關部分saml-schema-metadata-2.0.xsd：

<complexType name="SSODescriptorType" abstract="true">
  <complexContent>
    <extension base="md:RoleDescriptorType">
      <sequence>
        <element ref="md:ArtifactResolutionService" minOccurs="0" maxOccurs="unbounded"/>
        <element ref="md:SingleLogoutService" minOccurs="0" maxOccurs="unbounded"/>
        <element ref="md:ManageNameIDService" minOccurs="0" maxOccurs="unbounded"/>
        <element ref="md:NameIDFormat" minOccurs="0" maxOccurs="unbounded"/>
      </sequence>
    </extension>
  </complexContent>
</complexType>
<element name="ArtifactResolutionService" type="md:IndexedEndpointType"/>
<element name="SingleLogoutService" type="md:EndpointType"/>
<element name="ManageNameIDService" type="md:EndpointType"/>
<element name="NameIDFormat" type="anyURI"/>

<element name="IDPSSODescriptor" type="md:IDPSSODescriptorType"/>
<complexType name="IDPSSODescriptorType">
  <complexContent>
    <extension base="md:SSODescriptorType">
      <sequence>
        <element ref="md:SingleSignOnService" maxOccurs="unbounded"/>
        <element ref="md:NameIDMappingService" minOccurs="0" maxOccurs="unbounded"/>
        <element ref="md:AssertionIDRequestService" minOccurs="0" maxOccurs="unbounded"/>
        <element ref="md:AttributeProfile" minOccurs="0" maxOccurs="unbounded"/>
        <element ref="saml:Attribute" minOccurs="0" maxOccurs="unbounded"/>
      </sequence>
      <attribute name="WantAuthnRequestsSigned" type="boolean" use="optional"/>
    </extension>
  </complexContent>
</complexType>
<element name="SingleSignOnService" type="md:EndpointType"/>
<element name="NameIDMappingService" type="md:EndpointType"/>
<element name="AssertionIDRequestService" type="md:EndpointType"/>
<element name="AttributeProfile" type="anyURI"/>

我注意到錯誤訊息僅指定了來自IDPSSODescriptorType而不是 base的元素SSODescriptorType。也許這是設計使然？

無論如何，我沒有收到ArtifactResolutionService也恰好在基本型別中定義的錯誤。

事實上，如果我將<element ref="md:NameIDFormat" minOccurs="0" maxOccurs="unbounded"/>模式檔案從基礎SSODescriptorType移到IDPSSODescriptorType. 并保留其他所有內容，則元資料檔案將通過驗證。

我正在使用 Java 8 和默認實作javax.xml.validation.*

private static String[] schemas = {
  "/schema/xml.xsd",
  "/schema/XMLSchema.xsd",
  "/schema/xmldsig-core-schema.xsd",
  "/schema/xenc-schema.xsd",
  "/schema/saml-schema-assertion-2.0.xsd",
  "/schema/saml-schema-metadata-2.0.xsd",
};

public boolean validateXMLSchema(Document document) {
  try {
    SchemaFactory factory =
      SchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI);

    Schema schema = factory.newSchema(getSources().toArray(new Source[0]));

    Validator validator = schema.newValidator();
    validator.validate(new DOMSource(document));
    return true;
  } catch (SAXException e) {
    log.error("Exception: "   e.getMessage());
  } catch (Exception ex) {
    log.debug("Exception: ", ex);
  }

  return false;
}

在這一點上，我不確定是什么導致NameIDFormat元素驗證失敗，或者為什么驗證器沒有在基本型別中找到它，但似乎找到了ArtifactResolutionService.

uj5u.com熱心網友回復：

這個元素是如何產生的，它是在沒有它的 minOccurs= 屬性的情況下生成的，而相同集合型別的其他元素確實有它。，所以就像決議器錯誤所說的那樣有一個畸形。

<element  ref="md:SingleSignOnService" maxOccurs="unbounded"/>

uj5u.com熱心網友回復：

我弄清楚發生了什么事。客戶元資料確實無效（根據此架構）。

complexType架構中的s 指定sequences。這意味著必須以特定順序指定元素。

根據架構，必須在中定義的任何元素之前指定中定義的NameIDFormat元素。將元資料更改為以下作品：SSODescriptorTypeIDPSSODescriptorType

<IDPSSODescriptor protocolSupportEnumeration="urn:mace:shibboleth:1.0 urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:2.0:protocol">

  <Extensions>
    <shibmd:Scope regexp="false">...</shibmd:Scope>
  </Extensions>

  <KeyDescriptor>
    <ds:KeyInfo>
      <ds:X509Data>
        <ds:X509Certificate>
        ...
        </ds:X509Certificate>
      </ds:X509Data>
    </ds:KeyInfo>
  </KeyDescriptor>

  <ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding" Location="..." index="1"/>
  <ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="..." index="2"/>

  <NameIDFormat>urn:mace:shibboleth:1.0:nameIdentifier</NameIDFormat>
  <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>

  <SingleSignOnService Binding="urn:mace:shibboleth:1.0:profiles:AuthnRequest" Location="..."/>
  <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="..."/>
  <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="..."/>
  <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="h..."/>
</IDPSSODescriptor>

現在要弄清楚我將如何處理這個問題，因為我不太可能讓客戶修復他們的元資料......

轉載請註明出處，本文鏈接：https://www.uj5u.com/shujuku/512768.html

標籤：爪哇xmlxsd山姆xsd-验证

上一篇：不可見的XML語法不適用于此條目（使用Coffeepot）

下一篇：決議、更新、洗掉XML元素