OpenSAML user discussion

["David Del Vecchio" <>]

I'm having a few issues with OpenSAML processing Response StatusCodes. It
seems to expect the value to have a namespace prefix. For instance if I
use a response that looks like this:

<Response xmlns="urn:oasis:names:tc:SAML:1.0:protocol" ...>
    <Status>
        <StatusCode xmlns:samlp="urn:oasis:names:tc:SAML:1.0:protocol"    
           Value="samlp:Success" />
    </Status>
...
</Response>

everything will work fine, but if I leave out the prefix:
...
<StatusCode Value="Success" />
..

I get an exception when it tries to process the response:

 Caused by org.opensaml.SAMLException
        at org.opensaml.SAMLException.getInstance(SAMLException.java:189)
        at org.opensaml.SAMLResponse.fromDOM(SAMLResponse.java:180)
        at org.opensaml.SAMLResponse.&lt;init&gt;(SAMLResponse.java:126)

The problem seems to be that the contents of the Value attribute (in this
case success) are assumed to include a : (colon). If there is no prefix,
OpenSAML seems to look in the XML document for references to the ""
prefix.

In processing the Value attribute, the getQNameAttribute() of XML.java
will be called. This in turn will call getNamespaceForQName(), passing in
a QName of "Success". At the top of the getNamespaceForQName() method, the
prefix is set to an initial value of the empty string: "". Then since
"Success" doesn't have a prefix it searches for references to the ""
prefix, but doesn't find any. I think instead, prefix should have an
initial value of null. That way when it searches the documents for
namespace definitions, it will look for the default namespace and find a
match.

I'd be happy to submit a patch for this, but I'm not sure if the change
would cause any problems, it seems to do the trick for me.

David