2 * Licensed to the University Corporation for Advanced Internet
3 * Development, Inc. (UCAID) under one or more contributor license
4 * agreements. See the NOTICE file distributed with this work for
5 * additional information regarding copyright ownership.
7 * UCAID licenses this file to you under the Apache License,
8 * Version 2.0 (the "License"); you may not use this file except
9 * in compliance with the License. You may obtain a copy of the
12 * http://www.apache.org/licenses/LICENSE-2.0
14 * Unless required by applicable law or agreed to in writing,
15 * software distributed under the License is distributed on an
16 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
17 * either express or implied. See the License for the specific
18 * language governing permissions and limitations under the License.
22 * WhitelistMetadataFilter.cpp
24 * Removes non-whitelisted entities from a metadata instance
28 #include "saml2/metadata/EntityMatcher.h"
29 #include "saml2/metadata/Metadata.h"
30 #include "saml2/metadata/MetadataFilter.h"
32 #include <boost/bind.hpp>
33 #include <boost/scoped_ptr.hpp>
34 #include <xmltooling/logging.h>
36 using namespace opensaml::saml2md;
37 using namespace opensaml::saml2;
38 using namespace xmltooling::logging;
39 using namespace xmltooling;
40 using namespace boost;
45 class SAML_DLLLOCAL WhitelistMetadataFilter : public MetadataFilter
48 WhitelistMetadataFilter(const DOMElement* e);
49 ~WhitelistMetadataFilter() {}
51 const char* getId() const { return WHITELIST_METADATA_FILTER; }
52 void doFilter(XMLObject& xmlObject) const;
55 void filterGroup(EntitiesDescriptor*) const;
56 bool included(const EntityDescriptor&) const;
58 set<xstring> m_entities;
59 scoped_ptr<EntityMatcher> m_matcher;
62 MetadataFilter* SAML_DLLLOCAL WhitelistMetadataFilterFactory(const DOMElement* const & e)
64 return new WhitelistMetadataFilter(e);
67 static const XMLCh Include[] = UNICODE_LITERAL_7(I,n,c,l,u,d,e);
68 static const XMLCh matcher[] = UNICODE_LITERAL_7(m,a,t,c,h,e,r);
73 WhitelistMetadataFilter::WhitelistMetadataFilter(const DOMElement* e)
75 string matcher(XMLHelper::getAttrString(e, nullptr, matcher));
77 m_matcher.reset(SAMLConfig::getConfig().EntityMatcherManager.newPlugin(matcher.c_str(), e));
79 e = XMLHelper::getFirstChildElement(e, Include);
81 if (e->hasChildNodes()) {
82 const XMLCh* incl = e->getTextContent();
84 m_entities.insert(incl);
86 e = XMLHelper::getNextSiblingElement(e, Include);
90 void WhitelistMetadataFilter::doFilter(XMLObject& xmlObject) const
92 EntitiesDescriptor* group = dynamic_cast<EntitiesDescriptor*>(&xmlObject);
97 EntityDescriptor* entity = dynamic_cast<EntityDescriptor*>(&xmlObject);
99 if (!included(*entity))
100 throw MetadataFilterException(WHITELIST_METADATA_FILTER" MetadataFilter instructed to filter the root/only entity in the metadata.");
103 throw MetadataFilterException(WHITELIST_METADATA_FILTER" MetadataFilter was given an improper metadata instance to filter.");
108 void WhitelistMetadataFilter::filterGroup(EntitiesDescriptor* entities) const
110 Category& log = Category::getInstance(SAML_LOGCAT".MetadataFilter."WHITELIST_METADATA_FILTER);
112 VectorOf(EntityDescriptor) v = entities->getEntityDescriptors();
113 for (VectorOf(EntityDescriptor)::size_type i = 0; i < v.size(); ) {
114 if (!included(*v[i])) {
115 auto_ptr_char id(v[i]->getEntityID());
116 log.info("filtering out non-whitelisted entity (%s)", id.get());
117 v.erase(v.begin() + i);
124 const vector<EntitiesDescriptor*>& groups = const_cast<const EntitiesDescriptor*>(entities)->getEntitiesDescriptors();
125 for_each(groups.begin(), groups.end(), boost::bind(&WhitelistMetadataFilter::filterGroup, this, _1));
128 bool WhitelistMetadataFilter::included(const EntityDescriptor& entity) const
130 // Check for entityID.
131 if (entity.getEntityID() && !m_entities.empty() && m_entities.count(entity.getEntityID()) > 0)
134 if (m_matcher && m_matcher->matches(entity))