2 * Copyright 2001-2009 Internet2
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
8 * http://www.apache.org/licenses/LICENSE-2.0
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
20 * SAML 2.0 ECP profile message encoder.
24 #include "exceptions.h"
25 #include "binding/MessageEncoder.h"
26 #include "signature/ContentReference.h"
27 #include "saml1/core/Protocols.h"
28 #include "saml2/core/Protocols.h"
31 #include <xmltooling/logging.h>
32 #include <xmltooling/impl/AnyElement.h>
33 #include <xmltooling/io/HTTPResponse.h>
34 #include <xmltooling/util/NDC.h>
35 #include <xmltooling/signature/Signature.h>
36 #include <xmltooling/soap/SOAP.h>
38 using namespace samlconstants;
39 using namespace opensaml::saml2p;
40 using namespace opensaml::saml2md;
41 using namespace opensaml;
42 using namespace xmlconstants;
43 using namespace xmlsignature;
44 using namespace soap11;
45 using namespace xmltooling::logging;
46 using namespace xmltooling;
52 static const XMLCh ProviderName[] = UNICODE_LITERAL_12(P,r,o,v,i,d,e,r,N,a,m,e);
54 class SAML_DLLLOCAL SAML2ECPEncoder : public MessageEncoder
57 SAML2ECPEncoder(const DOMElement* e, const XMLCh* ns) : m_actor("http://schemas.xmlsoap.org/soap/actor/next"),
58 m_providerName(e ? e->getAttributeNS(ns, ProviderName) : NULL), m_idpList(NULL) {
59 DOMElement* child = e ? XMLHelper::getFirstChildElement(e, SAML20P_NS, IDPList::LOCAL_NAME) : NULL;
61 m_idpList = dynamic_cast<IDPList*>(XMLObjectBuilder::buildOneFromElement(child));
63 virtual ~SAML2ECPEncoder() {
68 GenericResponse& genericResponse,
70 const char* destination,
71 const EntityDescriptor* recipient=NULL,
72 const char* relayState=NULL,
73 const ArtifactGenerator* artifactGenerator=NULL,
74 const Credential* credential=NULL,
75 const XMLCh* signatureAlg=NULL,
76 const XMLCh* digestAlg=NULL
80 auto_ptr_XMLCh m_actor;
81 const XMLCh* m_providerName;
83 AnyElementBuilder m_anyBuilder;
86 MessageEncoder* SAML_DLLLOCAL SAML2ECPEncoderFactory(const pair<const DOMElement*,const XMLCh*>& p)
88 return new SAML2ECPEncoder(p.first, p.second);
93 long SAML2ECPEncoder::encode(
94 GenericResponse& genericResponse,
96 const char* destination,
97 const EntityDescriptor* recipient,
98 const char* relayState,
99 const ArtifactGenerator* artifactGenerator,
100 const Credential* credential,
101 const XMLCh* signatureAlg,
102 const XMLCh* digestAlg
106 xmltooling::NDC ndc("encode");
108 Category& log = Category::getInstance(SAML_LOGCAT".MessageEncoder.SAML2ECP");
110 log.debug("validating input");
111 if (xmlObject->getParent())
112 throw BindingException("Cannot encode XML content with parent.");
114 Response* response = NULL;
115 AuthnRequest* request = dynamic_cast<AuthnRequest*>(xmlObject);
117 response = dynamic_cast<Response*>(xmlObject);
119 throw BindingException("XML content for SAML 2.0 ECP Encoder must be a SAML 2.0 AuthnRequest or Response.");
122 if (request && !request->getAssertionConsumerServiceURL())
123 throw BindingException("AuthnRequest must carry an AssertionConsumerServiceURL by value.");
124 else if (response && !response->getDestination())
125 throw BindingException("Response must carry a Destination attribute.");
127 // PAOS request leg is a custom MIME type, SOAP response leg is just text/xml.
128 genericResponse.setContentType(request ? "application/vnd.paos+xml" : "text/xml");
129 HTTPResponse* httpResponse = dynamic_cast<HTTPResponse*>(&genericResponse);
131 httpResponse->setResponseHeader("Expires", "01-Jan-1997 12:00:00 GMT");
132 httpResponse->setResponseHeader("Cache-Control", "no-cache, no-store, must-revalidate, private");
133 httpResponse->setResponseHeader("Pragma", "no-cache");
136 // Wrap it in a SOAP envelope.
137 Envelope* env = EnvelopeBuilder::buildEnvelope();
138 Header* header = HeaderBuilder::buildHeader();
139 env->setHeader(header);
140 Body* body = BodyBuilder::buildBody();
142 body->getUnknownXMLObjects().push_back(xmlObject);
144 ElementProxy* hdrblock;
145 xmltooling::QName qMU(SOAP11ENV_NS, Header::MUSTUNDERSTAND_ATTRIB_NAME, SOAP11ENV_PREFIX);
146 xmltooling::QName qActor(SOAP11ENV_NS, Header::ACTOR_ATTRIB_NAME, SOAP11ENV_PREFIX);
149 // Create paos:Request header.
150 static const XMLCh service[] = UNICODE_LITERAL_7(s,e,r,v,i,c,e);
151 static const XMLCh responseConsumerURL[] = UNICODE_LITERAL_19(r,e,s,p,o,n,s,e,C,o,n,s,u,m,e,r,U,R,L);
152 hdrblock = dynamic_cast<ElementProxy*>(m_anyBuilder.buildObject(PAOS_NS, saml1p::Request::LOCAL_NAME, PAOS_PREFIX));
153 hdrblock->setAttribute(qMU, XML_ONE);
154 hdrblock->setAttribute(qActor, m_actor.get());
155 hdrblock->setAttribute(xmltooling::QName(NULL, service), SAML20ECP_NS);
156 hdrblock->setAttribute(xmltooling::QName(NULL, responseConsumerURL), request->getAssertionConsumerServiceURL());
157 header->getUnknownXMLObjects().push_back(hdrblock);
159 // Create ecp:Request header.
160 static const XMLCh IsPassive[] = UNICODE_LITERAL_9(I,s,P,a,s,s,i,v,e);
161 hdrblock = dynamic_cast<ElementProxy*>(m_anyBuilder.buildObject(SAML20ECP_NS, saml1p::Request::LOCAL_NAME, SAML20ECP_PREFIX));
162 hdrblock->setAttribute(qMU, XML_ONE);
163 hdrblock->setAttribute(qActor, m_actor.get());
164 if (!request->IsPassive())
165 hdrblock->setAttribute(xmltooling::QName(NULL,IsPassive), XML_ZERO);
167 hdrblock->setAttribute(xmltooling::QName(NULL,ProviderName), m_providerName);
168 hdrblock->getUnknownXMLObjects().push_back(request->getIssuer()->clone());
169 if (request->getScoping() && request->getScoping()->getIDPList())
170 hdrblock->getUnknownXMLObjects().push_back(request->getScoping()->getIDPList()->clone());
172 hdrblock->getUnknownXMLObjects().push_back(m_idpList->clone());
173 header->getUnknownXMLObjects().push_back(hdrblock);
176 // Create ecp:Response header.
177 hdrblock = dynamic_cast<ElementProxy*>(m_anyBuilder.buildObject(SAML20ECP_NS, Response::LOCAL_NAME, SAML20ECP_PREFIX));
178 hdrblock->setAttribute(qMU, XML_ONE);
179 hdrblock->setAttribute(qActor, m_actor.get());
180 hdrblock->setAttribute(xmltooling::QName(NULL,AuthnRequest::ASSERTIONCONSUMERSERVICEURL_ATTRIB_NAME), response->getDestination());
181 header->getUnknownXMLObjects().push_back(hdrblock);
184 if (relayState && *relayState) {
185 // Create ecp:RelayState header.
186 static const XMLCh RelayState[] = UNICODE_LITERAL_10(R,e,l,a,y,S,t,a,t,e);
187 hdrblock = dynamic_cast<ElementProxy*>(m_anyBuilder.buildObject(SAML20ECP_NS, RelayState, SAML20ECP_PREFIX));
188 hdrblock->setAttribute(qMU, XML_ONE);
189 hdrblock->setAttribute(qActor, m_actor.get());
190 auto_ptr_XMLCh rs(relayState);
191 hdrblock->setTextContent(rs.get());
192 header->getUnknownXMLObjects().push_back(hdrblock);
196 DOMElement* rootElement = NULL;
198 if (request->getSignature()) {
199 log.debug("message already signed, skipping signature operation");
200 rootElement = env->marshall();
203 log.debug("signing the message and marshalling the envelope");
205 // Build a Signature.
206 Signature* sig = SignatureBuilder::buildSignature();
207 request->setSignature(sig);
209 sig->setSignatureAlgorithm(signatureAlg);
211 opensaml::ContentReference* cr = dynamic_cast<opensaml::ContentReference*>(sig->getContentReference());
213 cr->setDigestAlgorithm(digestAlg);
216 // Sign message while marshalling.
217 vector<Signature*> sigs(1,sig);
218 rootElement = env->marshall((DOMDocument*)NULL,&sigs,credential);
222 log.debug("marshalling the envelope");
223 rootElement = env->marshall();
229 if (log.isDebugEnabled()) {
230 string forlog(s.str());
231 log.debug("marshalled envelope:\n%s", forlog.c_str());
234 log.debug("sending serialized envelope");
235 long ret = genericResponse.sendResponse(s);
237 // Cleanup by destroying XML.
241 catch (XMLToolingException&) {
242 // A bit weird...we have to "revert" things so that the message is isolated
243 // so the caller can free it.
244 xmlObject->getParent()->detach();