OpenSAML user discussion

["Scott Cantor" <>]

> It can do schema validation (not sure about schema 
> normalization) but I keep it turned off for performance.

Right. That's the fundamental issue. I think it may be worth looking at JAXB
simply because if I stop validating, I need some other robust way to insure
sane content. I don't know how all the other implementations do it, since I
know I'm the only one validating, but I'm supremely uncomfortable
implementing a security library that just pretends it knows what's in the
XML and ignores errors.

> I assume then that schema normalization is not being done by 
> JAXB in teh mode that I am using it as I do not observe any problems.

Normalization is part of validation. It affects whitespace, among other
things. If you don't validate, no normalization apart from XML 1.x stuff
takes place.

-- Scott