RE: XmlBeans and xml digitail signature

[Radu Preotiuc-Pietro]

Title: Message

I have thought about a feature along those lines. One place it would certainly be useful is when XmlBeans *has* to create prefix declarations because user code is setting a QName value (directly or indirectly) and so it is necessary to ensure that the meaning of that QName is preserved when the surrounding document changes.

But beyond this, I have doubts that it would be such a good idea, for example, it is not clear to me how the following scenario would work:

Suppose you want to create a document like:

 

...

<n:container xmlns:n="urn:test">

  <n:task/>

</n:container>, bottom up (so first create the children, then the parent).

...

 

You do

TaskType task = TaskType.Factory.newInstance();

ContainerType container = ContainerType.Factory.newInstance();

container.setTask(task);

 

At this point, "container" is unattached (so it has no element name), and it contains one "task" element, with an implicitly added "xmlns:n="urn:test"" namespace declaration.

Now, "container" gets attached to the larger document:

 

doc.setContainer(container)

 

but there is no declaration for the "urn:test" prefix in scope, so one gets generated "xmlns:n="urn:test"".

At this point, you have declarations for the "n" prefix on both the <container> and <task> elements, which I don't think most people would expect or want. In order to avoid this, XmlBeans would have to basically change the XML subtree that gets added and traverse it to search and remove all redundant namespace declarations - on every set().

 

I think the issue is that what XmlBeans generates is a so-called "synthetic infoset", an XML infoset which is legal, but could not have been generated by parsing a document. Maybe having a method that turns it into a "normal infoset" when you're done changing the document would be useful (which is mostly what you're already doing, but packaged). Or add all xmlns declarations to the root element, if you know a priori what namespaces are used.

 

Radu

 

-----Original Message-----
From: Giedrius Trumpickas [mailto:[EMAIL PROTECTED]
Sent: Wednesday, January 04, 2006 7:47 AM
To: user@xmlbeans.apache.org
Subject: Re: XmlBeans and xml digitail signature

Actually my solution to this problem was the same(I added namespace declarations  with XmlCursor). But it's not elegant and it looks like a hack. I think it would be useful to add following features:

1) Specify preferred namespace prefixes for namespace URI in xml beans config file or pass with options when creating xml bean instance
2) Have namespace attribute declarations in a new documents created by using XML beans.


Giedrius

On 1/3/06, Radu Preotiuc-Pietro <[EMAIL PROTECTED]> wrote:

Oh, ok, that actually makes sense, because when you are creating the document from scratch, you are not creating the namespace attributes, which is why you can then choose what prefixes you want when saving the document (you can even save the same document twice with different prefix mappings).

 

I guess I would try adding the namespace attributes "by hand" (using XmlCursor) after finishing creating the document.

 

Radu

 

-----Original Message-----
From: Giedrius Trumpickas [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, January 03, 2006 7:33 AM
To: user@xmlbeans.apache.org

Subject: Re: XmlBeans and xml digitail signature

Radu,

In your case it works because you are loading existing XML file with namespace prefixes and namespace declaration attributes.

Problem happens when you are creating a new XML bean instance and then trying to access DOM nodes.
There is no way how to specify namespaceURI to prefix mapping when creating instance of XML bean. Namespace declarations are missing as well.

When serializing to xml xmlText you can pass XmlOptions with prefixes but when creating you can't do it. I will send you a test case shortly.

Giedrius

On 1/2/06, Radu Preotiuc-Pietro <[EMAIL PROTECTED]> wrote:

Are you using XmlBeans V2? Both of those features work as per the DOM
spec as far as I know, this is the code I used to test this:

    XmlObject o = XmlObject.Factory.parse(new File("test.xml"));
    Document d = (Document) o.getDomNode();
    org.w3c.dom.Element e = d.getDocumentElement();
    System.out.println("Tag name: " + e.getTagName());
    NamedNodeMap atts = e.getAttributes();
    for (int i = 0; i < atts.getLength (); i++)
        System.out.println("name=" + atts.item(i).getNodeName() + ",
value=" + atts.item(i).getNodeValue());

Are you sure that these two things are what's causing issues? If you're
positive, then it would help if you could submit the particular use-case
that's giving you trouble, because in the general case, it seems to work
ok.

Thanks,
Radu

-----Original Message-----
From: Giedrius Trumpickas [mailto: [EMAIL PROTECTED]]
Sent: Thursday, December 29, 2005 11:31 AM
To: user@xmlbeans.apache.org
Subject: XmlBeans and xml digitail signature


Hi,

I have tried to use apache xml-security 1.3.0 framework to  create xml
digital signatures for xmlbean instances with no success.
Apache xml security framework uses DOM node as input for signature
creation but unfortunately xml beans DOM api does not work as expected.
I have compiled SAML 2.0 core schemas and trying to create SAML 2.0
assertion and digitally sign it.

I have noticed following problems:

1) There is no way how to get xmlns:* attribute value through xml beans
DOM API and apache xml security excpects it
3) Element#getTagName does not return fully qualified name namespace
prefix is missing

It would be nice to specify namespaceURI mapping to prefix when creating
new XML bean instances or specify at compile time when compiling
schemas, then Element#getTagName can return normal fully qualified name.

Without these features XML canonicalization of xml bean instances does
not work when trying to canonicalize by using apache xml security.
Is there is any plans to support xml security in XML beans? Or at least
XML digital signature.

Thanks,

Giedrius

---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]