The XML Schema recommendation defines a way for document authors to indicate the location of a schema file by means of the schemaLocation attribute.

In BPEL, XML Schema validation is a precondition for static analysis of a process document. This validation should always occur, regardless of the presence and possible value of the schemaLocation attribute.

Ignoring the value of the schemaLocation attribute is important because users could point to revised/corrupted versions of the schema that our parser is not prepared to handle. We want to be sure that the document conforms to the schema version known to our parser.

In JAXP, validation is not performed unless setValidating(true) is called on the documentBuilderFactory. See JAXP 1.3, chapter 3, section "Properties For Enabling Schema Validation" for details.

Furthermore, XML schema must be set as the validation language by invoking setAttribute(schemaLanguage, xmlSchemaURI). Otherwise DTD is expected.

The effect of the two settings above is that either:
schemaLocation must appear in the document, otherwise an error is reported. or
the schema file location must be provided to the documentBuilderFactory by calling setAttribute(schemaSource, schemaFileLocation)Either way, the schema file location is presented to the entityResolver afterwards.

The second option is preferable because (a) it does not require the presence of schemaLocation in the document, and (b) in case schemaLocation is present, it overrides the schema locations provided by the user. A third advantage is that it makes the entityResolver unnecessary, as the schemaFileLocation can point to a local resource directly.

Do you see other validation settings that should/should not be applied?