[OpenSAML] XACML Unmarshalling ClassCast XSAnyImpl Exceptions

[Anthony Whitehead]

Hi,

Just curious if I'm doing something horribly wrong to get the following class cast exceptions during unmashalling of any XACML XML. All other SAML Objects work fine.
Using Java 5, opensaml 2.3.1, xmltooling 1.2.1 and openws 1.3.0.

Here is the exception:

java.lang.ClassCastException: org.opensaml.xml.schema.impl.

XSAnyImpl
        at org.opensaml.xacml.profile.saml.impl.XACMLAuthzDecisionQueryTypeUnmarshaller.processAttribute(XACMLAuthzDecisionQueryTypeUnmarshaller.java:56)
        at org.opensaml.xml.io.AbstractXMLObjectUnmarshaller.unmarshallAttribute(AbstractXMLObjectUnmarshaller.java:236)
        at org.opensaml.xml.io.AbstractXMLObjectUnmarshaller.unmarshall(AbstractXMLObjectUnmarshaller.java:107)
        at testXACML.main(testXACML.java:53)

Here is the simple testing code:
public class testXACML {
    /**
     * @param args the command line arguments
     */
    public static void main(String[] args) {
        String file = "example_xacml_query.xml";
    try {
            DefaultBootstrap.bootstrap();

        InputStream in = new FileInputStream(file);
        BasicParserPool pool = new BasicParserPool();
        Document doc = pool.parse( in );

        Unmarshaller queryUnmarshaller = Configuration.getUnmarshallerFactory().getUnmarshaller(XACMLAuthzDecisionQueryType.DEFAULT_ELEMENT_NAME_XACML20);

        XACMLAuthzDecisionQueryType xacmlRequest = (XACMLAuthzDecisionQueryType)queryUnmarshaller.unmarshall( doc.getDocumentElement() ); // Line 53
        } catch( Exception e ) {
            e.printStackTrace();
        }
    } 
}

And here is the simple XACML data:
<?xml version="1.0" encoding="UTF-8"?><xacml-samlp:XACMLAuthzDecisionQuery xmlns:xacml-samlp="urn:oasis:xacml:2.0:saml:protocol:schema:os" Destination="https://eh.mysmartxs.com/getronicsap/SAMLResponder" ID="_4dc8f18dc1db53a8ea986c8213640e50" IssueInstant="2010-04-22T17:27:35.379Z" ReturnContext="true" Version="2.0" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"><saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">testissuer</saml:Issuer>
<xacml-context:Request xmlns:xacml-context="urn:oasis:names:tc:xacml:2.0:context:schema:os">
<xacml-context:Subject><xacml-context:Attribute AttributeId="userid" DataType="http://www.w3.org/2001/XMLSchema#string" Issuer="testissuer"><xacml-context:AttributeValue>test</xacml-context:AttributeValue></xacml-context:Attribute></xacml-context:Subject>
<xacml-context:Resource><xacml-context:Attribute AttributeId="resourcename" DataType="http://www.w3.org/2001/XMLSchema#string"><xacml-context:AttributeValue>myresource</xacml-context:AttributeValue></xacml-context:Attribute></xacml-context:Resource>
<xacml-context:Action><xacml-context:Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" DataType="http://www.w3.org/2001/XMLSchema#string"><xacml-context:AttributeValue>Authenticate</xacml-context:AttributeValue></xacml-context:Attribute></xacml-context:Action>
<xacml-context:Environment/>
</xacml-context:Request>
</xacml-samlp:XACMLAuthzDecisionQuery>

So, what am I doing wrong?

Thanks,

/Ant

[Brent Putman]

On 4/23/10 11:45 AM, Anthony Whitehead wrote:
>
> Here is the exception:
>
> java.lang.ClassCastException: org.opensaml.xml.schema.impl.
> XSAnyImpl
>

The actual runtime object that's getting unmarshalled appears to be an
XSAny, which is the default object provider that's used when the Element
or type QName is not one that has registered support in the providers
registered with the unmarshaller factory.

>
> Here is the simple testing code:
>
>

> Unmarshaller queryUnmarshaller =
> Configuration.getUnmarshallerFactory().getUnmarshaller(XACMLAuthzDecisionQueryType.DEFAULT_ELEMENT_NAME_XACML20);
>


That actual cast error above is happening ultimately b/c you're
explictly getting an unmarshaller for that specific type, as opposed to
using getUnmarshaller(element) and letting it up the right unmarshaller
impl based on the actual element that you are using. Although doing
that wouldn't solve your problem (see below), you'd basically just be
pushing the casting error to a different point in your processing
(assuming you eventually cast it in your code to a
XACMLAuthzDecisionQueryType).

>
> And here is the simple XACML data:
> <?xml version="1.0"
> encoding="UTF-8"?><xacml-samlp:XACMLAuthzDecisionQuery
> xmlns:xacml-samlp="urn:oasis:xacml:2.0:saml:protocol:schema:os"

But you're real problem is here. The SAML profile of XACML that's
supported in OpenSAML is not that one. See this Jira issue, which will
hopefully explain things:


https://bugs.internet2.edu/jira/browse/JOST-34


Basically, there is no object provider support in OpenSAML for a
XACMLAuthzDecisionQuery element from the namespace
urn:oasis:xacml:2.0:saml:protocol:schema:os. The OpenSAML supports is
from namespace
urn:oasis:names:tc:xacml:2.0:profile:saml2.0:v2:schema:protocol.


HTH,
Brent




--
Subscription settings: http://groups.google.com/group/opensaml-users/subscribe?hl=en

[massimil...@gmail.com]

Hi Brent,

I'm experiencing a similar problem. I was unable to marshall a
Assertion that was
containing an umarshalled XACMLPolicyStatement, because of the XSAnyImpl
class cast. Now, after changing a bit the namespaces, I have another
error (see below).

I've a method that obtains a PolicySet as org.w3c.dom.Element,
unmarshalls it in a
PolicySetType correctly.

I want to create a new SAML assertion (a Delegated one) containing one
Authentication
Statement, one AttributeStatement and a XACMLPolicyStatement.

// here the code for unmarshalling the policy:

XACMLPolicyStatementTypeImplBuilder stmtBuilder =
(XACMLPolicyStatementTypeImplBuilder)bf.getBuilder(XACMLPolicyStatementType.DEFAULT_ELEMENT_NAME_XACML20);
XACMLPolicyStatementType stmt =
stmtBuilder.buildObject(SAMLProfileConstants.SAML20XACML20_NS,
XACMLPolicyStatementType.DEFAULT_ELEMENT_LOCAL_NAME,
SAMLProfileConstants.SAML20XACMLASSERTION_PREFIX);


UnmarshallerFactory unmarshallerFactory =
org.opensaml.xml.Configuration.getUnmarshallerFactory();
Unmarshaller policyQueryUnmarshaller =
unmarshallerFactory.getUnmarshaller(PolicySetType.DEFAULT_ELEMENT_NAME);
PolicySetType p;
try {
p = (PolicySetType)policyQueryUnmarshaller.unmarshall(this.policy);
stmt.getPolicySets().add(p);

} catch (UnmarshallingException e1) {
throw new IdentityProviderException(e1);
}

assertion.getStatements().add(stmt);


// end here

// here the code for Marshalling everything:
MarshallerFactory marshallerFactory = Configuration
.getMarshallerFactory();
Marshaller marshaller = marshallerFactory
.getMarshaller(Assertion.DEFAULT_ELEMENT_NAME);

try {
assertionElement = marshaller.marshall(assertion);
} catch (MarshallingException e) {
throw new IdentityProviderException(e);
}


the error is:

08:33:36,266 ERROR [STDERR] org.opensaml.xml.XMLRuntimeException: DOM
Element node adoption failed
08:33:36,278 ERROR [STDERR] at
org.opensaml.xml.util.XMLHelper.adoptElement(XMLHelper.java:482)
08:33:36,283 ERROR [STDERR] at
org.opensaml.xml.util.XMLHelper.appendChildElement(XMLHelper.java:467)
08:33:36,283 ERROR [STDERR] at
org.opensaml.xml.io.AbstractXMLObjectMarshaller.marshall(AbstractXMLObjectMarshaller.java:161)
08:33:36,283 ERROR [STDERR] at
org.opensaml.xml.io.AbstractXMLObjectMarshaller.marshallChildElements(AbstractXMLObjectMarshaller.java:316)
08:33:36,283 ERROR [STDERR] at
org.opensaml.xml.io.AbstractXMLObjectMarshaller.marshallInto(AbstractXMLObjectMarshaller.java:224)
08:33:36,283 ERROR [STDERR] at
org.opensaml.xml.io.AbstractXMLObjectMarshaller.marshall(AbstractXMLObjectMarshaller.java:175)
08:33:36,283 ERROR [STDERR] at
org.opensaml.xml.io.AbstractXMLObjectMarshaller.marshallChildElements(AbstractXMLObjectMarshaller.java:316)
08:33:36,283 ERROR [STDERR] at
org.opensaml.xml.io.AbstractXMLObjectMarshaller.marshallInto(AbstractXMLObjectMarshaller.java:224)
08:33:36,284 ERROR [STDERR] at
org.opensaml.xml.io.AbstractXMLObjectMarshaller.marshall(AbstractXMLObjectMarshaller.java:130)
08:33:36,284 ERROR [STDERR] at
org.opensaml.xml.io.AbstractXMLObjectMarshaller.marshall(AbstractXMLObjectMarshaller.java:86)
08:33:36,284 ERROR [STDERR] at
com.spirit.saml.issuers.oo.OOHoKXSPA.buildAssertion(OOHoKXSPA.java:517)
08:33:36,284 ERROR [STDERR] at
com.spirit.saml.issuers.oo.OOHoKXSPAMessageReceiver.process(OOHoKXSPAMessageReceiver.java:281)
08:33:36,284 ERROR [STDERR] at
com.spirit.saml.MessageReceiver.soap12Request(MessageReceiver.java:64)
08:33:36,284 ERROR [STDERR] at
com.spirit.soap.SoapServer.executeSoap12(SoapServer.java:345)
08:33:36,284 ERROR [STDERR] at
com.spirit.soap.SoapServer.doPost(SoapServer.java:153)
08:33:36,284 ERROR [STDERR] at
javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
08:33:36,284 ERROR [STDERR] at
javax.servlet.http.HttpServlet.service(HttpServlet.java:810)
08:33:36,284 ERROR [STDERR] at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:252)
08:33:36,284 ERROR [STDERR] at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173)
08:33:36,284 ERROR [STDERR] at
org.jboss.web.tomcat.filters.ReplyHeaderFilter.doFilter(ReplyHeaderFilter.java:96)
08:33:36,284 ERROR [STDERR] at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:202)
08:33:36,284 ERROR [STDERR] at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173)
08:33:36,284 ERROR [STDERR] at
org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:213)
08:33:36,284 ERROR [STDERR] at
org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:178)
08:33:36,284 ERROR [STDERR] at
org.jboss.web.tomcat.security.SecurityAssociationValve.invoke(SecurityAssociationValve.java:175)
08:33:36,284 ERROR [STDERR] at
org.jboss.web.tomcat.security.JaccContextValve.invoke(JaccContextValve.java:74)
08:33:36,284 ERROR [STDERR] at
org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:126)
08:33:36,284 ERROR [STDERR] at
org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:105)
08:33:36,285 ERROR [STDERR] at
org.jboss.web.tomcat.tc5.jca.CachedConnectionValve.invoke(CachedConnectionValve.java:156)
08:33:36,285 ERROR [STDERR] at
org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:107)
08:33:36,285 ERROR [STDERR] at
org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:148)
08:33:36,285 ERROR [STDERR] at
org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:869)
08:33:36,285 ERROR [STDERR] at
org.apache.coyote.http11.Http11BaseProtocol$Http11ConnectionHandler.processConnection(Http11BaseProtocol.java:664)
08:33:36,285 ERROR [STDERR] at
org.apache.tomcat.util.net.PoolTcpEndpoint.processSocket(PoolTcpEndpoint.java:527)
08:33:36,285 ERROR [STDERR] at
org.apache.tomcat.util.net.MasterSlaveWorkerThread.run(MasterSlaveWorkerThread.java:112)
08:33:36,285 ERROR [STDERR] at java.lang.Thread.run(Thread.java:637)





using opensaml 2.3.1.

--
Massimiliano Masi

http://www.mascanc.net/~max

[Anthony Whitehead]

Thanks for the response Brent, I understand the issue now.

Since several other implementations are using the older version of the profile (and it still seems to be the published
official version!!), is there a version of OpenSAML that contains support for the older profile? I can imagine that this
issue hurts OpenSAML interoperation in some cases.

I don't mind using the xmltooling library to roll my own support for this older profile, but I'd rather not have to.

Again, thanks for the response,

/Ant

[Chad La Joie]

On 4/24/10 6:37 AM, Anthony Whitehead wrote:
> Since several other implementations are using the older version of the
> profile (and it still seems to be the published
> official version!!), is there a version of OpenSAML that contains
> support for the older profile? I can imagine that this
> issue hurts OpenSAML interoperation in some cases.

No, using the older profile would hurt interoperation. Because of
mistakes made in the old profile there is no way to construct messages
that both conform to that profile and conform to the SAML spec. That's
why we chose to use a draft document when we did the implementation,
because it corrected the problem.

--
Chad La Joie
www.itumi.biz
trusted identities, delivered

[Anthony Whitehead]

Thanks for the clarification on that Chad, its good to understand the reasoning behind the implementation.

Does anyone know when the draft profile will be made official?

/Ant