2 * Copyright 2001-2007 Internet2
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
8 * http://www.apache.org/licenses/LICENSE-2.0
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
18 * AbstractMetadataProvider.cpp
20 * Base class for caching metadata providers.
24 #include "binding/SAMLArtifact.h"
25 #include "saml2/metadata/Metadata.h"
26 #include "saml2/metadata/AbstractMetadataProvider.h"
27 #include "saml2/metadata/MetadataCredentialContext.h"
28 #include "saml2/metadata/MetadataCredentialCriteria.h"
30 #include <xercesc/util/XMLUniDefs.hpp>
31 #include <xmltooling/security/KeyInfoResolver.h>
32 #include <xmltooling/util/XMLHelper.h>
34 using namespace opensaml::saml2md;
35 using namespace xmltooling;
37 using opensaml::SAMLArtifact;
39 static const XMLCh _KeyInfoResolver[] = UNICODE_LITERAL_15(K,e,y,I,n,f,o,R,e,s,o,l,v,e,r);
40 static const XMLCh type[] = UNICODE_LITERAL_4(t,y,p,e);
42 AbstractMetadataProvider::AbstractMetadataProvider(const DOMElement* e)
43 : ObservableMetadataProvider(e), m_resolver(NULL), m_credentialLock(NULL)
45 e = e ? XMLHelper::getFirstChildElement(e, _KeyInfoResolver) : NULL;
47 auto_ptr_char t(e->getAttributeNS(NULL,type));
49 m_resolver = XMLToolingConfig::getConfig().KeyInfoResolverManager.newPlugin(t.get(),e);
51 throw UnknownExtensionException("<KeyInfoResolver> element found with no type attribute");
53 m_credentialLock = Mutex::create();
56 AbstractMetadataProvider::~AbstractMetadataProvider()
58 for (credmap_t::iterator c = m_credentialMap.begin(); c!=m_credentialMap.end(); ++c)
59 for_each(c->second.begin(), c->second.end(), xmltooling::cleanup<Credential>());
60 delete m_credentialLock;
64 void AbstractMetadataProvider::emitChangeEvent() const
66 for (credmap_t::iterator c = m_credentialMap.begin(); c!=m_credentialMap.end(); ++c)
67 for_each(c->second.begin(), c->second.end(), xmltooling::cleanup<Credential>());
68 m_credentialMap.clear();
69 ObservableMetadataProvider::emitChangeEvent();
72 void AbstractMetadataProvider::index(EntityDescriptor* site, time_t validUntil, bool replace) const
74 if (validUntil < site->getValidUntilEpoch())
75 site->setValidUntil(validUntil);
77 auto_ptr_char id(site->getEntityID());
80 m_sites.erase(id.get());
81 for (sitemap_t::iterator s = m_sources.begin(); s != m_sources.end();) {
82 if (s->second == site) {
83 sitemap_t::iterator temp = s;
85 m_sources.erase(temp);
92 m_sites.insert(sitemap_t::value_type(id.get(),site));
95 // Process each IdP role.
96 const vector<IDPSSODescriptor*>& roles=const_cast<const EntityDescriptor*>(site)->getIDPSSODescriptors();
97 for (vector<IDPSSODescriptor*>::const_iterator i=roles.begin(); i!=roles.end(); i++) {
99 if ((*i)->hasSupport(samlconstants::SAML10_PROTOCOL_ENUM) || (*i)->hasSupport(samlconstants::SAML11_PROTOCOL_ENUM)) {
100 // Check for SourceID extension element.
101 const Extensions* exts=(*i)->getExtensions();
102 if (exts && exts->hasChildren()) {
103 const vector<XMLObject*>& children=exts->getUnknownXMLObjects();
104 for (vector<XMLObject*>::const_iterator ext=children.begin(); ext!=children.end(); ++ext) {
105 SourceID* sid=dynamic_cast<SourceID*>(*ext);
107 auto_ptr_char sourceid(sid->getID());
108 if (sourceid.get()) {
109 m_sources.insert(sitemap_t::value_type(sourceid.get(),site));
117 m_sources.insert(sitemap_t::value_type(SAMLConfig::getConfig().hashSHA1(id.get(), true),site));
119 // Load endpoints for type 0x0002 artifacts.
120 const vector<ArtifactResolutionService*>& locs=const_cast<const IDPSSODescriptor*>(*i)->getArtifactResolutionServices();
121 for (vector<ArtifactResolutionService*>::const_iterator loc=locs.begin(); loc!=locs.end(); loc++) {
122 auto_ptr_char location((*loc)->getLocation());
124 m_sources.insert(sitemap_t::value_type(location.get(),site));
129 if ((*i)->hasSupport(samlconstants::SAML20P_NS)) {
131 m_sources.insert(sitemap_t::value_type(SAMLConfig::getConfig().hashSHA1(id.get(), true),site));
136 void AbstractMetadataProvider::index(EntitiesDescriptor* group, time_t validUntil) const
138 if (validUntil < group->getValidUntilEpoch())
139 group->setValidUntil(validUntil);
141 auto_ptr_char name(group->getName());
143 m_groups.insert(groupmap_t::value_type(name.get(),group));
146 const vector<EntitiesDescriptor*>& groups=const_cast<const EntitiesDescriptor*>(group)->getEntitiesDescriptors();
147 for (vector<EntitiesDescriptor*>::const_iterator i=groups.begin(); i!=groups.end(); i++)
148 index(*i,group->getValidUntilEpoch());
150 const vector<EntityDescriptor*>& sites=const_cast<const EntitiesDescriptor*>(group)->getEntityDescriptors();
151 for (vector<EntityDescriptor*>::const_iterator j=sites.begin(); j!=sites.end(); j++)
152 index(*j,group->getValidUntilEpoch());
155 void AbstractMetadataProvider::clearDescriptorIndex(bool freeSites)
158 for_each(m_sites.begin(), m_sites.end(), cleanup_const_pair<string,EntityDescriptor>());
164 const EntitiesDescriptor* AbstractMetadataProvider::getEntitiesDescriptor(const char* name, bool strict) const
166 pair<groupmap_t::const_iterator,groupmap_t::const_iterator> range=const_cast<const groupmap_t&>(m_groups).equal_range(name);
168 time_t now=time(NULL);
169 for (groupmap_t::const_iterator i=range.first; i!=range.second; i++)
170 if (now < i->second->getValidUntilEpoch())
173 if (!strict && range.first!=range.second)
174 return range.first->second;
179 pair<const EntityDescriptor*,const RoleDescriptor*> AbstractMetadataProvider::getEntityDescriptor(const Criteria& criteria) const
181 pair<sitemap_t::const_iterator,sitemap_t::const_iterator> range;
182 if (criteria.entityID_ascii)
183 range = const_cast<const sitemap_t&>(m_sites).equal_range(criteria.entityID_ascii);
184 else if (criteria.entityID_unicode) {
185 auto_ptr_char id(criteria.entityID_unicode);
186 range = const_cast<const sitemap_t&>(m_sites).equal_range(id.get());
188 else if (criteria.artifact)
189 range = const_cast<const sitemap_t&>(m_sources).equal_range(criteria.artifact->getSource());
191 return pair<const EntityDescriptor*,const RoleDescriptor*>(NULL,NULL);
193 pair<const EntityDescriptor*,const RoleDescriptor*> result;
195 result.second = NULL;
197 time_t now=time(NULL);
198 for (sitemap_t::const_iterator i=range.first; i!=range.second; i++) {
199 if (now < i->second->getValidUntilEpoch()) {
200 result.first = i->second;
205 if (!result.first && !criteria.validOnly && range.first!=range.second)
206 result.first = range.first->second;
208 if (result.first && criteria.role && criteria.protocol) {
209 result.second = result.first->getRoleDescriptor(*criteria.role, criteria.protocol);
210 if (!result.second && criteria.protocol2)
211 result.second = result.first->getRoleDescriptor(*criteria.role, criteria.protocol2);
217 const Credential* AbstractMetadataProvider::resolve(const CredentialCriteria* criteria) const
219 const MetadataCredentialCriteria* metacrit = dynamic_cast<const MetadataCredentialCriteria*>(criteria);
221 throw MetadataException("Cannot resolve credentials without a MetadataCredentialCriteria object.");
223 Lock lock(m_credentialLock);
224 const credmap_t::mapped_type& creds = resolveCredentials(metacrit->getRole());
226 for (credmap_t::mapped_type::const_iterator c = creds.begin(); c!=creds.end(); ++c)
227 if (metacrit->matches(*(*c)))
232 vector<const Credential*>::size_type AbstractMetadataProvider::resolve(
233 vector<const Credential*>& results, const CredentialCriteria* criteria
236 const MetadataCredentialCriteria* metacrit = dynamic_cast<const MetadataCredentialCriteria*>(criteria);
238 throw MetadataException("Cannot resolve credentials without a MetadataCredentialCriteria object.");
240 Lock lock(m_credentialLock);
241 const credmap_t::mapped_type& creds = resolveCredentials(metacrit->getRole());
243 for (credmap_t::mapped_type::const_iterator c = creds.begin(); c!=creds.end(); ++c)
244 if (metacrit->matches(*(*c)))
245 results.push_back(*c);
246 return results.size();
249 const AbstractMetadataProvider::credmap_t::mapped_type& AbstractMetadataProvider::resolveCredentials(const RoleDescriptor& role) const
251 credmap_t::const_iterator i = m_credentialMap.find(&role);
252 if (i!=m_credentialMap.end())
255 const KeyInfoResolver* resolver = m_resolver ? m_resolver : XMLToolingConfig::getConfig().getKeyInfoResolver();
256 const vector<KeyDescriptor*>& keys = role.getKeyDescriptors();
257 AbstractMetadataProvider::credmap_t::mapped_type& resolved = m_credentialMap[&role];
258 for (vector<KeyDescriptor*>::const_iterator k = keys.begin(); k!=keys.end(); ++k) {
259 if ((*k)->getKeyInfo()) {
260 auto_ptr<MetadataCredentialContext> mcc(new MetadataCredentialContext(*(*k)));
261 Credential* c = resolver->resolve(mcc.get());
263 resolved.push_back(c);