|
Replies:
14
-
Last Post:
Nov 8, 2007 8:16 AM
by: mischaz
|
|
|
|
|
|
|
Validataing incoming SOAP messages with Glassfish V2
Posted:
Sep 27, 2007 3:42 AM
|
|
|
Hi all
I was sent here from binary WS and XML forum:
I have a problem with implementing WS using NB 6 and Glassfish v2. We can send any wrong xml message to WS endpoint (SOAP over HTTP) and it is passed to lower framework layers instead of throwing some schema validation fault. In case of other app servers we used to get schema validation as soon as wrong message arrived. It is a serious problem for us, as some of our consumers are quite inadvanced and they build WS clients using string concatenation, not WS frameworks  and they consume a lot of troubles when they get some lower level exceptions. I guess it has something in common with FI and processing optimization, but I need your help to switch validation on as it is more important at this point than performance.
|
|
|
|
|
|
|
Re: Validataing incoming SOAP messages with Glassfish V2
Posted:
Sep 27, 2007 3:26 PM
in response to: akulinsk
|
|
|
Currently we dont have XML schema validation feature. You can either try to dump the SOAP message to see for yourself, which is quite hard. Or better, you can write a SOAP handler and using JAXP Validator to validate the SOAP payload.
We plan to implement this feature, see REF, https://jax-ws.dev.java.net/issues/show_bug.cgi?id=151.
|
|
|
|
|
|
|
|
|
Re: Validataing incoming SOAP messages with Glassfish V2
Posted:
Sep 28, 2007 12:19 AM
in response to: vivekp
|
|
|
Thanks for your replay, we'll try to handle situation 
|
|
|
|
|
|
|
|
|
Re: Validataing incoming SOAP messages with Glassfish V2
Posted:
Oct 18, 2007 1:26 PM
in response to: vivekp
|
|
|
Any time-frame for implementing this?
|
|
|
|
|
|
|
|
|
Re: Validataing incoming SOAP messages with Glassfish V2
Posted:
Oct 18, 2007 2:25 PM
in response to: vladchuk
|
|
|
Though there is some work remaining, most of the part is working in 2.1.3 for doc/lit(just implemented few days back). See the sample schema_validation.
|
|
|
|
|
|
|
|
|
Re: Validataing incoming SOAP messages with Glassfish V2
Posted:
Oct 19, 2007 2:01 PM
in response to: jitu
|
|
|
Great! But what do you mean by 2.1.3? I only know of Metro 1.0. Also, how do I make it work in Glassfish - is there going to be an update for it any time soon?
Thanks.
|
|
|
|
|
|
|
|
|
Re: Validataing incoming SOAP messages with Glassfish V2
Posted:
Oct 24, 2007 12:11 PM
in response to: vivekp
|
|
|
When will this ship and when will it officially become part of Glassfish?
|
|
|
|
|
|
|
|
|
Re: Validataing incoming SOAP messages with Glassfish V2
Posted:
Oct 20, 2007 5:55 AM
in response to: akulinsk
|
|
|
Looking at the latest nightly build, as far as I can see you rely on parsing wsdl and fetching the XSD nodes from it and validating the payload against the types there (which is why only document:literal works). Is this the best approach? It just seems to me a failure of the design of JAXB, because as far as I am concerned this belongs there. One of the stated goals of JAXB is to save you from having to parse your XSD over and over again. I must say I like how AXIS2 solves this problem. They generate code to check the incoming data: i.e. based on min and max Occurs, choice etc.
What I am actually wondering as well is if anybody is / was actually using JAX-WS in producting environments. A WS without validation is as good as useless in my opinion. I mean how were people handling the validation: building in check into code to verify if the data was acceptable?
|
|
|
|
|
|
|
|
|
Re: Validataing incoming SOAP messages with Glassfish V2
Posted:
Oct 25, 2007 11:45 AM
in response to: davelane
|
|
|
JAXB generated portable artifacts do not capture the facets in the schema. I don't think it is possible capture all the details in the annotations of the generated artifacts. So the only way is to use JAXP's schema validation facility by parsing the xsds.
The xsd are parsed only once to create JAXP's Schema object. Once the service is deployed, there is no parsing of xsds. The only overhead is to copy the request/response message infoset for validation. As far as the rpc/lit is concerned, one can create pseudo schema and use it for validation. It is not done in the implementation.
|
|
|
|
|
|
|
|
|
Re: Validataing incoming SOAP messages with Glassfish V2
Posted:
Oct 26, 2007 4:36 PM
in response to: jitu
|
|
|
Hi Jitu,
thanks very much for the reply.
> JAXB generated portable artifacts do not capture the facets in the schema.
I can imagine that would be the case, but I would be interested in which details of the schema cannot be captured. Choices?
> I don't think it is possible capture all the details in the annotations of the generated artifacts. So the only way is to use JAXP's schema validation facility by parsing the xsds.
Well I don't thinks it's the ONLY way. Like I said, AFAIK Axis converts the XSD to a piece of validation java code.
> The xsd are parsed only once to create JAXP's Schema object. Once the service is deployed, there is no parsing of xsds.
When does the one parse happen? When the service is called? When glassfish is started? How does this work exactly if you don't mind me asking? I am genuinely interested.
Like I said in my original response, I am wondering how anyone could deploy a service without validation. Are there any hints as to when 2.1.3 with validation will be released.
|
|
|
|
|
|
|
|
|
Re: Validataing incoming SOAP messages with Glassfish V2
Posted:
Oct 29, 2007 2:23 AM
in response to: davelane
|
|
|
I have implemented a similar scheme that now has been incorporated into 2.1.3. I extended WSServlet to extract the schema from wsdl during initialization (startup). This schema is parsed into a JAXP Schema. The validator for the schema is stored in ServletContext. The validation occurs in a logical message handler which obtains the validator from ServletContext. Thus no re-parsing occurs during runtime.
The hardest part by far was to extract the schema from the wsdl. It amazes me that there still does not exist support for this in JDK even though wsdl has been around for years.
I think JAXP validation is the right thing to do so I am very pleased to see this implemented in 2.1.3.
regards
Martti
|
|
|
|
|
|
|
|
|
Re: Validataing incoming SOAP messages with Glassfish V2
Posted:
Nov 1, 2007 5:26 PM
in response to: davelane
|
|
|
IIRC, you are right that the current implementation is limited to doc/lit because we simply extract all schema definitions and pass that to the JAXP RI. But I think it's relatively straight-forward to expand this further into rpc/lit by synthesizing the schema fragment.
I'm not sure why you consider this a design failure of JAXB, as the validation belongs to JAXP, and the rpc/lit semantics belongs to WSDL, thus JAX-WS. I think it would be rather pointless if these three technologies try to overlap with each other.
That said, it would be indeed desirable if XJC can capture the schema when it compiles it, then pass along to the runtime for easier access. Doing this in portable fashion is actually somewhat tricky, which was the primary reason we haven't done that already. Maybe this is what you meant.
As for generating the validation code, that's exactly what we did in JAXB1, and overall people didn't like that. It is also really really difficult to get the schema constraints implemented exactly right. Even if you are just using seamingly simple schema constructs, what consistutes a valid document and what is not is still very much a non-trivial problem.
|
|
|
|
|
|
|
|
|
Re: Validataing incoming SOAP messages with Glassfish V2
Posted:
Nov 4, 2007 10:46 AM
in response to: kohsuke
|
|
|
Yip that's more or less what I mean. For me I use xjc / JAXB / wsimport to be able to more or less throw away the XSD / WSDL. If I then have to hang on to the XSD (in a programatic sense) in order to validate the incoming / outgoing XML then it all seems a little pointless.
I actually thought that was one of the design goals of JAXB, although looking at the project pages I can't find anything like that mentioned, maybe it was in articles or books that I saw it.
> which was the primary reason we haven't done that already.
Was? Does that mean it is a goal for future versions?
> As for generating the validation code, that's exactly what we did in JAXB1, and overall people didn't like that.
Without trying to offend you, I see more people now asking where it went and complaining that it is gone.
Message was edited by: davelane
|
|
|
|
|
|
|
|
|
Re: Validataing incoming SOAP messages with Glassfish V2
Posted:
Nov 8, 2007 8:15 AM
in response to: davelane
|
|
|
The actual NB has some unexpected Features. The Source-Zip contains a SchemaValidation.java which differs from the compiled class file.
(Missing headers flag)
But neverless the @SchemaValidation Annotation is not working, required Fields still allowed to be null.
Message was edited by: mischaz
|
|
|
|
|
java.net RSS
