axis-java-user mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Derek" <derek-a...@crc-corp.com>
Subject RE: Schema Validation (WAS: [axis2] Validating Messages :: WSDL :: <choice>)
Date Wed, 12 Jul 2006 19:38:36 GMT


> -----Original Message-----
> From: Anne Thomas Manes [mailto:atmanes@gmail.com] 
> Sent: Wednesday, July 12, 2006 11:50 AM
> To: axis-user@ws.apache.org
> Subject: Re: Schema Validation (WAS: [axis2] Validating 
> Messages :: WSDL :: <choice>)
> 
> As I said in my original response, a databinding framework 
> will always perform some basic validation -- it's expecting 
> to get a particular XML structure that it knows how to map to 
> a particular object graph. If you feed it an unexpected XML 
> structure, it will barf. That's not the same a validation, 
> though. Is it appropriate to check for valid nulls during 
> data binding? Enumerations? Regular expression formatting 
> constraints? Maybe. But where do you draw the line?

Personally, I'd like to be able to "flick a switch" and turn full schema
validation on, using a real XML validator (like the one built into various
Apache XML parsing libraries) as a preprocessing phase prior to parsing the
XML with a databinding framework. I'd like to test the system in this
configuration for several months against actual data that clients are
sending me. I might leave the system this way indefinitely if performance
seems acceptable. Otherwise, IF I observe that performance seems to be a
problem, I would turn validation off, and run the system in that mode unless
I get some indication that garbage data is showing up, in which case I might
turn validation on again temporarily to diagnose the problem.

I think that turning on and off validation should be an extremely simple
operation that should be possible with Axis configured in its default
configuration. I shouldn't have to search the Internet for a handler that
some third party has written to do it, or to have to write one myself. I
think that a simple setting "validate-schema='somewhere.xsd'
validate='true'" in a server config file should be sufficient to turn
validation on or off, and possibly interactively through the web
administration interface as well. I also think that the user guide should
explain exactly how to turn this feature on and off, so I don't have to
search the mailing lists to figure out how to do it, and the feature ends up
getting used widely by many users.

I was pretty surprised, in fact, to find out that Axis and Axis2 apparently
can't do this. I would think that validation would be an extremely commonly
used feature for debugging purposes.

As far as whether or not a databinding framework itself should perform
constraint checking, I would like to point out that in most cases, anyone
writing a robust web service is going to have to do that checking anyway,
since there's no telling what kinds of garbage a generic client to that
webservice might send. So if the databinding framework cannot be trusted to
validate the XML it parses, the burden is then placed on the person using
the databinding framework to write checking code, and manually keep it in
sync with the contents of the schema. For instance, every time the getFoo()
method is called, the user might need to check it for a possibly null return
value. If a regular expression in the schema changes, the checking code must
be manually changed to correspond, etc. I don't really see how this
situation is preferable to having the databinding framework do the checking
itself. I have had to write a lot of this kind of manual checking code, and
I consider it a major waste of time.

I can see that someone who absolutely must run their code at top possible
speed for some reason, and who has some kind of contractual arrangement with
ALL of their clients such that the clients can be trusted to send only
schematically valid data, might want to turn off such checking. I think that
there should be options in WSDL2Java to omit at least the more expensive
kinds of checking. Still, every company I have worked in has wanted that
checking left on all the time if possible. Part of the reason I use a
databinding framework in the first place is that I want to have some of
those checks happen without me having to explicitly code them myself. I
would like that to happen as much as possible.

Derek

> 
> Anne
> 
> On 7/12/06, Doug B <ummmmm22@gmail.com> wrote:
> > Anne doesn't appear to be around right now, but I'll bug 
> her when it 
> > looks like she is.  In the meantime, surely some of the other list 
> > readers have some opinions on this topic?
> >
> > On 7/9/06, Benjamin Fan <btyfan@gmail.com> wrote:
> > >
> > > If there is going to be a discussion then I would very 
> much like to 
> > > participate in it. I am in the middle of building a production 
> > > system where I do in fact need to validate against the schema. In 
> > > fact the WSDL (doc
> > > literal) will form the basis of a commercial interface 
> specification for 3rd
> > > parties. They will not be Java.
> > >
> > > Best Regards,
> > >
> > >
> > > Benjamin Fam
> > >
> > >
> > >
> > > On 7/10/06, Doug B <ummmmm22@gmail.com> wrote:
> > > > <warning: long, "best practice" questions to follow>
> > > >
> > > > Interesting to hear you say that, Anne.  I've been on a 
> multi-year 
> > > > quest to get automatic, fast validation out of a Web Services 
> > > > engine. Conceptually, it always seemed like the "right" 
> approach 
> > > > (especially for Document-Literal).  If you're having to 
> parse XML 
> > > > anyway, and your XML parser can validate when it does 
> so, why not 
> > > > do it, actually enforcing your restrictive WSDL/Schema at the 
> > > > layer that defines and understands it?
> > > >
> > > > At the time, Axis did not do this at all, but my 
> Bugzilla feature 
> > > > request seemed to get agreement that this was a good goal:
> > > >
> > > > http://issues.apache.org/jira/browse/AXIS-222
> > > >
> > > > Also at that time, I tried out Systinet Wasp, which did do 
> > > > auto-validation.  Much later, I came across the DeveloperWorks 
> > > > article about combining Axis and Castor to get auto-validation:
> > > >
> > > >
> > > 
> http://www-128.ibm.com/developerworks/webservices/library/ws-castor/
> > > >
> > > > This approach was exactly what I was seeking, so we 
> started using 
> > > > it. It's very simple, but it does seem slow.  (I'm also not 
> > > > getting pure POJOs for my "schema" beans, which I'd 
> really like, 
> > > > but Castor's aren't too bad.  Haven't found an XML 
> framework that 
> > > > generates clean POJOs from a schema and don't want to write 
> > > > mapping files if I can help it.)
> > > >
> > > > Along the way, we asked everyone we could whether or not 
> > > > auto-validation was a good approach, and we got responses all 
> > > > across the spectrum.  Clearly some people expect and 
> want it, but 
> > > > others don't.  Some engines can do it, but others 
> can't.  If the 
> > > > only reason not to do it is performance, will the newer 
> parsers or 
> > > > something like JiBX make a significant difference?  What if you 
> > > > have access to an XML appliance?  Would more people do 
> it in that 
> > > > case?  I suppose an engine that let you enable and 
> disable it at 
> > > > will would be nice.
> > > >
> > > > I'm not exactly sure where I stand at this point, but I'm not 
> > > > quite willing to give up on the "dream".  That is, the dream of 
> > > > wholly specifying my interface via WSDL/Schema, and having a WS 
> > > > engine completely wrap, translate, and validate 
> > > > requests/responses/exceptions, hiding from my business code the 
> > > > fact that it's even being accessed as a Web Service, 
> but ensuring 
> > > > that anything that comes through the Web Service 
> interface doesn't 
> > > > violate the Web Service's specification.  I've started 
> accepting 
> > > > the value of having my business code do business validations as 
> > > > well (namely in cases where I want to use it from other 
> > > > interfaces), but it just seems too natural, logically, 
> for the XML 
> > > > parsing layer to do it. Otherwise, you're throwing away much of 
> > > > the information you've carefully specified (in a handwritten, 
> > > > authoritative, contract WSDL, at least).
> > > >
> > > > I'd be happy to take this discussion somewhere else, since it's 
> > > > really not specific to Axis, if you'd like and if you 
> have time to 
> > > > participate in it.  Thanks.
> > > >
> > > > Doug
> > > >
> > > > On 7/7/06, Anne Thomas Manes < atmanes@gmail.com> wrote:
> > > > > Axis makes no attempt to validate messages. (It's 
> very expensive 
> > > > > process that would significantly degrade performance). A 
> > > > > databinding system will catch many validation issues, but it 
> > > > > also does not do true validation. If you pass in 
> elements that 
> > > > > it doesn't expect, it will reject the request. But as long as 
> > > > > the message matches what the databinding system can 
> deal with, 
> > > > > it will pass.
> > > > >
> > > > > If you want to validate the message, then use a handler or 
> > > > > intermediary to do so.
> > > > >
> > > > > Anne
> > > > >
> > > > >
> > > 
> --------------------------------------------------------------------
> > > -
> > > > > To unsubscribe, e-mail:
> > > axis-user-unsubscribe@ws.apache.org
> > > > > For additional commands, e-mail: axis-user-help@ws.apache.org
> > > > >
> > > > >
> > > >
> > > >
> > > 
> --------------------------------------------------------------------
> > > -
> > > > To unsubscribe, e-mail:
> > > axis-user-unsubscribe@ws.apache.org
> > > > For additional commands, e-mail: axis-user-help@ws.apache.org
> > > >
> > > >
> > >
> > >
> >
> > 
> ---------------------------------------------------------------------
> > To unsubscribe, e-mail: axis-user-unsubscribe@ws.apache.org
> > For additional commands, e-mail: axis-user-help@ws.apache.org
> >
> >
> 
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: axis-user-unsubscribe@ws.apache.org
> For additional commands, e-mail: axis-user-help@ws.apache.org
> 
> 



---------------------------------------------------------------------
To unsubscribe, e-mail: axis-user-unsubscribe@ws.apache.org
For additional commands, e-mail: axis-user-help@ws.apache.org


Mime
View raw message