shib-target/shib-ini.cpp

   1 /*
   2  *  Copyright 2001-2005 Internet2
   3  *
   4  * Licensed under the Apache License, Version 2.0 (the "License");
   5  * you may not use this file except in compliance with the License.
   6  * You may obtain a copy of the License at
   7  *
   8  *     http://www.apache.org/licenses/LICENSE-2.0
   9  *
  10  * Unless required by applicable law or agreed to in writing, software
  11  * distributed under the License is distributed on an "AS IS" BASIS,
  12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13  * See the License for the specific language governing permissions and
  14  * limitations under the License.
  15  */
  16
  17 /*
  18  * shib-ini.h -- config file handling, now XML-based
  19  *
  20  * $Id$
  21  */
  22
  23 #include "internal.h"
  24
  25 #include <shib/shib-threads.h>
  26 #include <log4cpp/Category.hh>
  27 #include <log4cpp/PropertyConfigurator.hh>
  28
  29 #include <sys/types.h>
  30 #include <sys/stat.h>
  31
  32 using namespace std;
  33 using namespace saml;
  34 using namespace shibboleth;
  35 using namespace shibtarget;
  36 using namespace log4cpp;
  37
  38 namespace shibtarget {
  39
  40     // Application configuration wrapper
  41     class XMLApplication : public virtual IApplication, public XMLPropertySet, public DOMNodeFilter
  42     {
  43     public:
  44         XMLApplication(const IConfig*, const Iterator<ICredentials*>& creds, const DOMElement* e, const XMLApplication* base=NULL);
  45         ~XMLApplication() { cleanup(); }
  46
  47         // IPropertySet
  48         pair<bool,bool> getBool(const char* name, const char* ns=NULL) const;
  49         pair<bool,const char*> getString(const char* name, const char* ns=NULL) const;
  50         pair<bool,const XMLCh*> getXMLString(const char* name, const char* ns=NULL) const;
  51         pair<bool,unsigned int> getUnsignedInt(const char* name, const char* ns=NULL) const;
  52         pair<bool,int> getInt(const char* name, const char* ns=NULL) const;
  53         const IPropertySet* getPropertySet(const char* name, const char* ns="urn:mace:shibboleth:target:config:1.0") const;
  54
  55         // IApplication
  56         const char* getId() const {return getString("id").second;}
  57         const char* getHash() const {return m_hash.c_str();}
  58         Iterator<SAMLAttributeDesignator*> getAttributeDesignators() const;
  59         Iterator<IAAP*> getAAPProviders() const;
  60         Iterator<IMetadata*> getMetadataProviders() const;
  61         Iterator<ITrust*> getTrustProviders() const;
  62         Iterator<const XMLCh*> getAudiences() const;
  63         const IPropertySet* getCredentialUse(const IEntityDescriptor* provider) const;
  64         const SAMLBrowserProfile* getBrowserProfile() const {return m_profile;}
  65         const SAMLBinding* getBinding(const XMLCh* binding) const
  66             {return XMLString::compareString(SAMLBinding::SOAP,binding) ? NULL : m_binding;}
  67         SAMLBrowserProfile::ArtifactMapper* getArtifactMapper() const {return new STArtifactMapper(this);}
  68         const IPropertySet* getDefaultSessionInitiator() const;
  69         const IPropertySet* getSessionInitiatorById(const char* id) const;
  70         const IPropertySet* getDefaultAssertionConsumerService() const;
  71         const IPropertySet* getAssertionConsumerServiceByIndex(unsigned short index) const;
  72         const IPropertySet* getHandlerConfig(const char* path) const;
  73
  74         // Provides filter to exclude special config elements.
  75         short acceptNode(const DOMNode* node) const;
  76
  77     private:
  78         void cleanup();
  79         const IConfig* m_ini;   // this is ok because its locking scope includes us
  80         const XMLApplication* m_base;
  81         string m_hash;
  82         vector<SAMLAttributeDesignator*> m_designators;
  83         vector<IAAP*> m_aaps;
  84         vector<IMetadata*> m_metadatas;
  85         vector<ITrust*> m_trusts;
  86         vector<const XMLCh*> m_audiences;
  87         ShibBrowserProfile* m_profile;
  88         SAMLBinding* m_binding;
  89         ShibHTTPHook* m_bindingHook;
  90         map<string,XMLPropertySet*> m_handlerMap;
  91         map<unsigned int,const IPropertySet*> m_acsMap;
  92         const IPropertySet* m_acsDefault;
  93         map<string,const IPropertySet*> m_sessionInitMap;
  94         const IPropertySet* m_sessionInitDefault;
  95         XMLPropertySet* m_credDefault;
  96 #ifdef HAVE_GOOD_STL
  97         map<xstring,XMLPropertySet*> m_credMap;
  98 #else
  99         map<const XMLCh*,XMLPropertySet*> m_credMap;
 100 #endif
 101     };
 102
 103     // Top-level configuration implementation
 104     class XMLConfig;
 105     class XMLConfigImpl : public ReloadableXMLFileImpl, public XMLPropertySet, public DOMNodeFilter
 106     {
 107     public:
 108         XMLConfigImpl(const char* pathname, bool first, const XMLConfig* outer)
 109             : ReloadableXMLFileImpl(pathname), m_outer(outer), m_requestMapper(NULL) { init(first); }
 110         XMLConfigImpl(const DOMElement* e, bool first, const XMLConfig* outer)
 111             : ReloadableXMLFileImpl(e), m_outer(outer), m_requestMapper(NULL) { init(first); }
 112         ~XMLConfigImpl();
 113
 114         IRequestMapper* m_requestMapper;
 115         map<string,IApplication*> m_appmap;
 116         vector<ICredentials*> m_creds;
 117         vector<IAttributeFactory*> m_attrFactories;
 118
 119         // Provides filter to exclude special config elements.
 120         short acceptNode(const DOMNode* node) const;
 121
 122     private:
 123         void init(bool first);
 124         const XMLConfig* m_outer;
 125     };
 126
 127     class XMLConfig : public IConfig, public ReloadableXMLFile
 128     {
 129     public:
 130         XMLConfig(const DOMElement* e) : ReloadableXMLFile(e), m_listener(NULL), m_sessionCache(NULL), m_replayCache(NULL) {}
 131         ~XMLConfig() {delete m_listener; delete m_sessionCache; delete m_replayCache;}
 132
 133         // IPropertySet
 134         pair<bool,bool> getBool(const char* name, const char* ns=NULL) const {return static_cast<XMLConfigImpl*>(m_impl)->getBool(name,ns);}
 135         pair<bool,const char*> getString(const char* name, const char* ns=NULL) const {return static_cast<XMLConfigImpl*>(m_impl)->getString(name,ns);}
 136         pair<bool,const XMLCh*> getXMLString(const char* name, const char* ns=NULL) const {return static_cast<XMLConfigImpl*>(m_impl)->getXMLString(name,ns);}
 137         pair<bool,unsigned int> getUnsignedInt(const char* name, const char* ns=NULL) const {return static_cast<XMLConfigImpl*>(m_impl)->getUnsignedInt(name,ns);}
 138         pair<bool,int> getInt(const char* name, const char* ns=NULL) const {return static_cast<XMLConfigImpl*>(m_impl)->getInt(name,ns);}
 139         const IPropertySet* getPropertySet(const char* name, const char* ns="urn:mace:shibboleth:target:config:1.0") const {return static_cast<XMLConfigImpl*>(m_impl)->getPropertySet(name,ns);}
 140         const DOMElement* getElement() const {return static_cast<XMLConfigImpl*>(m_impl)->getElement();}
 141
 142         // IConfig
 143         const IListener* getListener() const {return m_listener;}
 144         ISessionCache* getSessionCache() const {return m_sessionCache;}
 145         IReplayCache* getReplayCache() const {return m_replayCache;}
 146         IRequestMapper* getRequestMapper() const {return static_cast<XMLConfigImpl*>(m_impl)->m_requestMapper;}
 147         const IApplication* getApplication(const char* applicationId) const {
 148             map<string,IApplication*>::const_iterator i=static_cast<XMLConfigImpl*>(m_impl)->m_appmap.find(applicationId);
 149             return (i!=static_cast<XMLConfigImpl*>(m_impl)->m_appmap.end()) ? i->second : NULL;
 150         }
 151         Iterator<ICredentials*> getCredentialsProviders() const {return static_cast<XMLConfigImpl*>(m_impl)->m_creds;}
 152
 153     protected:
 154         virtual ReloadableXMLFileImpl* newImplementation(const char* pathname, bool first=true) const;
 155         virtual ReloadableXMLFileImpl* newImplementation(const DOMElement* e, bool first=true) const;
 156
 157     private:
 158         friend class XMLConfigImpl;
 159         mutable IListener* m_listener;
 160         mutable ISessionCache* m_sessionCache;
 161         mutable IReplayCache* m_replayCache;
 162     };
 163 }
 164
 165 IConfig* STConfig::ShibTargetConfigFactory(const DOMElement* e)
 166 {
 167     auto_ptr<XMLConfig> ret(new XMLConfig(e));
 168     ret->getImplementation();
 169     return ret.release();
 170 }
 171
 172 XMLPropertySet::~XMLPropertySet()
 173 {
 174     for (map<string,pair<char*,const XMLCh*> >::iterator i=m_map.begin(); i!=m_map.end(); i++)
 175         XMLString::release(&(i->second.first));
 176     for (map<string,IPropertySet*>::iterator j=m_nested.begin(); j!=m_nested.end(); j++)
 177         delete j->second;
 178 }
 179
 180 void XMLPropertySet::load(
 181     const DOMElement* e,
 182     Category& log,
 183     DOMNodeFilter* filter,
 184     const std::map<std::string,std::string>* remapper
 185     )
 186 {
 187 #ifdef _DEBUG
 188     saml::NDC ndc("load");
 189 #endif
 190     m_root=e;
 191
 192     // Process each attribute as a property.
 193     DOMNamedNodeMap* attrs=m_root->getAttributes();
 194     for (XMLSize_t i=0; i<attrs->getLength(); i++) {
 195         DOMNode* a=attrs->item(i);
 196         if (!XMLString::compareString(a->getNamespaceURI(),saml::XML::XMLNS_NS))
 197             continue;
 198         char* val=XMLString::transcode(a->getNodeValue());
 199         if (val && *val) {
 200             auto_ptr_char ns(a->getNamespaceURI());
 201             auto_ptr_char name(a->getLocalName());
 202             const char* realname=name.get();
 203             if (remapper) {
 204                 map<string,string>::const_iterator remap=remapper->find(realname);
 205                 if (remap!=remapper->end()) {
 206                     log.debug("remapping property (%s) to (%s)",realname,remap->second.c_str());
 207                     realname=remap->second.c_str();
 208                 }
 209             }
 210             if (ns.get()) {
 211                 m_map[string("{") + ns.get() + '}' + realname]=pair<char*,const XMLCh*>(val,a->getNodeValue());
 212                 log.debug("added property {%s}%s (%s)",ns.get(),realname,val);
 213             }
 214             else {
 215                 m_map[realname]=pair<char*,const XMLCh*>(val,a->getNodeValue());
 216                 log.debug("added property %s (%s)",realname,val);
 217             }
 218         }
 219     }
 220
 221     // Process non-excluded elements as nested sets.
 222     DOMTreeWalker* walker=
 223         static_cast<DOMDocumentTraversal*>(
 224             m_root->getOwnerDocument())->createTreeWalker(const_cast<DOMElement*>(m_root),DOMNodeFilter::SHOW_ELEMENT,filter,false
 225             );
 226     e=static_cast<DOMElement*>(walker->firstChild());
 227     while (e) {
 228         auto_ptr_char ns(e->getNamespaceURI());
 229         auto_ptr_char name(e->getLocalName());
 230         const char* realname=name.get();
 231         if (remapper) {
 232             map<string,string>::const_iterator remap=remapper->find(realname);
 233             if (remap!=remapper->end()) {
 234                 log.debug("remapping property set (%s) to (%s)",realname,remap->second.c_str());
 235                 realname=remap->second.c_str();
 236             }
 237         }
 238         string key;
 239         if (ns.get())
 240             key=string("{") + ns.get() + '}' + realname;
 241         else
 242             key=realname;
 243         if (m_nested.find(key)!=m_nested.end())
 244             log.warn("load() skipping duplicate property set: %s",key.c_str());
 245         else {
 246             XMLPropertySet* set=new XMLPropertySet();
 247             set->load(e,log,filter,remapper);
 248             m_nested[key]=set;
 249             log.debug("added nested property set: %s",key.c_str());
 250         }
 251         e=static_cast<DOMElement*>(walker->nextSibling());
 252     }
 253     walker->release();
 254 }
 255
 256 pair<bool,bool> XMLPropertySet::getBool(const char* name, const char* ns) const
 257 {
 258     pair<bool,bool> ret=pair<bool,bool>(false,false);
 259     map<string,pair<char*,const XMLCh*> >::const_iterator i;
 260
 261     if (ns)
 262         i=m_map.find(string("{") + ns + '}' + name);
 263     else
 264         i=m_map.find(name);
 265
 266     if (i!=m_map.end()) {
 267         ret.first=true;
 268         ret.second=(!strcmp(i->second.first,"true") || !strcmp(i->second.first,"1"));
 269     }
 270     return ret;
 271 }
 272
 273 pair<bool,const char*> XMLPropertySet::getString(const char* name, const char* ns) const
 274 {
 275     pair<bool,const char*> ret=pair<bool,const char*>(false,NULL);
 276     map<string,pair<char*,const XMLCh*> >::const_iterator i;
 277
 278     if (ns)
 279         i=m_map.find(string("{") + ns + '}' + name);
 280     else
 281         i=m_map.find(name);
 282
 283     if (i!=m_map.end()) {
 284         ret.first=true;
 285         ret.second=i->second.first;
 286     }
 287     return ret;
 288 }
 289
 290 pair<bool,const XMLCh*> XMLPropertySet::getXMLString(const char* name, const char* ns) const
 291 {
 292     pair<bool,const XMLCh*> ret=pair<bool,const XMLCh*>(false,NULL);
 293     map<string,pair<char*,const XMLCh*> >::const_iterator i;
 294
 295     if (ns)
 296         i=m_map.find(string("{") + ns + '}' + name);
 297     else
 298         i=m_map.find(name);
 299
 300     if (i!=m_map.end()) {
 301         ret.first=true;
 302         ret.second=i->second.second;
 303     }
 304     return ret;
 305 }
 306
 307 pair<bool,unsigned int> XMLPropertySet::getUnsignedInt(const char* name, const char* ns) const
 308 {
 309     pair<bool,unsigned int> ret=pair<bool,unsigned int>(false,0);
 310     map<string,pair<char*,const XMLCh*> >::const_iterator i;
 311
 312     if (ns)
 313         i=m_map.find(string("{") + ns + '}' + name);
 314     else
 315         i=m_map.find(name);
 316
 317     if (i!=m_map.end()) {
 318         ret.first=true;
 319         ret.second=strtol(i->second.first,NULL,10);
 320     }
 321     return ret;
 322 }
 323
 324 pair<bool,int> XMLPropertySet::getInt(const char* name, const char* ns) const
 325 {
 326     pair<bool,int> ret=pair<bool,int>(false,0);
 327     map<string,pair<char*,const XMLCh*> >::const_iterator i;
 328
 329     if (ns)
 330         i=m_map.find(string("{") + ns + '}' + name);
 331     else
 332         i=m_map.find(name);
 333
 334     if (i!=m_map.end()) {
 335         ret.first=true;
 336         ret.second=atoi(i->second.first);
 337     }
 338     return ret;
 339 }
 340
 341 const IPropertySet* XMLPropertySet::getPropertySet(const char* name, const char* ns) const
 342 {
 343     map<string,IPropertySet*>::const_iterator i;
 344
 345     if (ns)
 346         i=m_nested.find(string("{") + ns + '}' + name);
 347     else
 348         i=m_nested.find(name);
 349
 350     return (i!=m_nested.end()) ? i->second : NULL;
 351 }
 352
 353 XMLApplication::XMLApplication(
 354     const IConfig* ini,
 355     const Iterator<ICredentials*>& creds,
 356     const DOMElement* e,
 357     const XMLApplication* base
 358     ) : m_ini(ini), m_base(base), m_profile(NULL), m_binding(NULL), m_bindingHook(NULL),
 359         m_credDefault(NULL), m_sessionInitDefault(NULL), m_acsDefault(NULL)
 360 {
 361 #ifdef _DEBUG
 362     saml::NDC ndc("XMLApplication");
 363 #endif
 364     Category& log=Category::getInstance("shibtarget.XMLApplication");
 365
 366     try {
 367         // First load any property sets.
 368         map<string,string> root_remap;
 369         root_remap["shire"]="session";
 370         root_remap["shireURL"]="handlerURL";
 371         root_remap["shireSSL"]="handlerSSL";
 372         load(e,log,this,&root_remap);
 373         const IPropertySet* propcheck=getPropertySet("Errors");
 374         if (propcheck && !propcheck->getString("session").first)
 375             throw ConfigurationException("<Errors> element requires 'session' (or deprecated 'shire') attribute");
 376         propcheck=getPropertySet("Sessions");
 377         if (propcheck && !propcheck->getString("handlerURL").first)
 378             throw ConfigurationException("<Sessions> element requires 'handlerURL' (or deprecated 'shireURL') attribute");
 379
 380         m_hash=getId();
 381         m_hash+=getString("providerId").second;
 382         m_hash=SAMLArtifact::toHex(SAMLArtifactType0001::generateSourceId(m_hash.c_str()));
 383
 384         ShibTargetConfig& conf=ShibTargetConfig::getConfig();
 385         SAMLConfig& shibConf=SAMLConfig::getConfig();
 386
 387         if (conf.isEnabled(ShibTargetConfig::RequestMapper)) {
 388             // Process handlers.
 389             bool hardACS=false, hardSessionInit=false;
 390             DOMElement* handler=saml::XML::getFirstChildElement(propcheck->getElement());
 391             while (handler) {
 392                 XMLPropertySet* hprops=new XMLPropertySet();
 393                 hprops->load(handler,log,this); // filter irrelevant for now, no embedded elements expected
 394                 m_handlerMap[hprops->getString("Location").second]=hprops;
 395
 396                 // If it's an ACS or SI, handle lookup mappings and defaulting.
 397                 if (saml::XML::isElementNamed(handler,shibtarget::XML::SAML2META_NS,SHIBT_L(AssertionConsumerService))) {
 398                     m_acsMap[hprops->getUnsignedInt("index").second]=hprops;
 399                     if (!hardACS) {
 400                         pair<bool,bool> defprop=hprops->getBool("isDefault");
 401                         if (defprop.first) {
 402                             if (defprop.second) {
 403                                 hardACS=true;
 404                                 m_acsDefault=hprops;
 405                             }
 406                         }
 407                         else if (!m_acsDefault)
 408                             m_acsDefault=hprops;
 409                     }
 410                 }
 411                 else if (saml::XML::isElementNamed(handler,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(SessionInitiator))) {
 412                     pair<bool,const char*> si_id=hprops->getString("id");
 413                     if (si_id.first && si_id.second)
 414                         m_sessionInitMap[si_id.second]=hprops;
 415                     if (!hardSessionInit) {
 416                         pair<bool,bool> defprop=hprops->getBool("isDefault");
 417                         if (defprop.first) {
 418                             if (defprop.second) {
 419                                 hardSessionInit=true;
 420                                 m_sessionInitDefault=hprops;
 421                             }
 422                         }
 423                         else if (!m_sessionInitDefault)
 424                             m_sessionInitDefault=hprops;
 425                     }
 426                 }
 427                 handler=saml::XML::getNextSiblingElement(handler);
 428             }
 429         }
 430
 431         // Process general configuration elements.
 432         unsigned int i;
 433         DOMNodeList* nlist=e->getElementsByTagNameNS(saml::XML::SAML_NS,L(AttributeDesignator));
 434         for (i=0; nlist && i<nlist->getLength(); i++)
 435             if (nlist->item(i)->getParentNode()->isSameNode(e))
 436                 m_designators.push_back(new SAMLAttributeDesignator(static_cast<DOMElement*>(nlist->item(i))));
 437
 438         nlist=e->getElementsByTagNameNS(saml::XML::SAML_NS,L(Audience));
 439         for (i=0; nlist && i<nlist->getLength(); i++)
 440             if (nlist->item(i)->getParentNode()->isSameNode(e))
 441                 m_audiences.push_back(nlist->item(i)->getFirstChild()->getNodeValue());
 442
 443         // Always include our own providerId as an audience.
 444         m_audiences.push_back(getXMLString("providerId").second);
 445
 446         if (conf.isEnabled(ShibTargetConfig::AAP)) {
 447             nlist=e->getElementsByTagNameNS(shibtarget::XML::SHIBTARGET_NS,SHIBT_L(AAPProvider));
 448             for (i=0; nlist && i<nlist->getLength(); i++) {
 449                 if (nlist->item(i)->getParentNode()->isSameNode(e)) {
 450                     auto_ptr_char type(static_cast<DOMElement*>(nlist->item(i))->getAttributeNS(NULL,SHIBT_L(type)));
 451                     log.info("building AAP provider of type %s...",type.get());
 452                     try {
 453                         IPlugIn* plugin=shibConf.getPlugMgr().newPlugin(type.get(),static_cast<DOMElement*>(nlist->item(i)));
 454                         IAAP* aap=dynamic_cast<IAAP*>(plugin);
 455                         if (aap)
 456                             m_aaps.push_back(aap);
 457                         else {
 458                             delete plugin;
 459                             log.crit("plugin was not an AAP provider");
 460                         }
 461                     }
 462                     catch (SAMLException& ex) {
 463                         log.crit("error building AAP provider: %s",ex.what());
 464                     }
 465                 }
 466             }
 467         }
 468
 469         if (conf.isEnabled(ShibTargetConfig::Metadata)) {
 470             nlist=e->getElementsByTagNameNS(shibtarget::XML::SHIBTARGET_NS,SHIBT_L(MetadataProvider));
 471             for (i=0; nlist && i<nlist->getLength(); i++) {
 472                 if (nlist->item(i)->getParentNode()->isSameNode(e)) {
 473                     auto_ptr_char type(static_cast<DOMElement*>(nlist->item(i))->getAttributeNS(NULL,SHIBT_L(type)));
 474                     log.info("building metadata provider of type %s...",type.get());
 475                     try {
 476                         IPlugIn* plugin=shibConf.getPlugMgr().newPlugin(type.get(),static_cast<DOMElement*>(nlist->item(i)));
 477                         IMetadata* md=dynamic_cast<IMetadata*>(plugin);
 478                         if (md)
 479                             m_metadatas.push_back(md);
 480                         else {
 481                             delete plugin;
 482                             log.crit("plugin was not a metadata provider");
 483                         }
 484                     }
 485                     catch (SAMLException& ex) {
 486                         log.crit("error building metadata provider: %s",ex.what());
 487                     }
 488                 }
 489             }
 490             nlist=e->getElementsByTagNameNS(shibtarget::XML::SHIBTARGET_NS,SHIBT_L(FederationProvider));
 491             for (i=0; nlist && i<nlist->getLength(); i++) {
 492                 if (nlist->item(i)->getParentNode()->isSameNode(e)) {
 493                     auto_ptr_char type(static_cast<DOMElement*>(nlist->item(i))->getAttributeNS(NULL,SHIBT_L(type)));
 494                     log.info("building metadata provider of type %s...",type.get());
 495                     try {
 496                         IPlugIn* plugin=shibConf.getPlugMgr().newPlugin(type.get(),static_cast<DOMElement*>(nlist->item(i)));
 497                         IMetadata* md=dynamic_cast<IMetadata*>(plugin);
 498                         if (md)
 499                             m_metadatas.push_back(md);
 500                         else {
 501                             delete plugin;
 502                             log.crit("plugin was not a metadata provider");
 503                         }
 504                     }
 505                     catch (SAMLException& ex) {
 506                         log.crit("error building metadata provider: %s",ex.what());
 507                     }
 508                 }
 509             }
 510         }
 511
 512         if (conf.isEnabled(ShibTargetConfig::Trust)) {
 513             nlist=e->getElementsByTagNameNS(shibtarget::XML::SHIBTARGET_NS,SHIBT_L(TrustProvider));
 514             for (i=0; nlist && i<nlist->getLength(); i++) {
 515                 if (nlist->item(i)->getParentNode()->isSameNode(e)) {
 516                     auto_ptr_char type(static_cast<DOMElement*>(nlist->item(i))->getAttributeNS(NULL,SHIBT_L(type)));
 517                     log.info("building trust provider of type %s...",type.get());
 518                     try {
 519                         IPlugIn* plugin=shibConf.getPlugMgr().newPlugin(type.get(),static_cast<DOMElement*>(nlist->item(i)));
 520                         ITrust* trust=dynamic_cast<ITrust*>(plugin);
 521                         if (trust)
 522                             m_trusts.push_back(trust);
 523                         else {
 524                             delete plugin;
 525                             log.crit("plugin was not a trust provider");
 526                         }
 527                     }
 528                     catch (SAMLException& ex) {
 529                         log.crit("error building trust provider: %s",ex.what());
 530                     }
 531                 }
 532             }
 533         }
 534
 535         // Finally, load credential mappings.
 536         const DOMElement* cu=saml::XML::getFirstChildElement(e,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(CredentialUse));
 537         if (cu) {
 538             m_credDefault=new XMLPropertySet();
 539             m_credDefault->load(cu,log,this);
 540             cu=saml::XML::getFirstChildElement(cu,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(RelyingParty));
 541             while (cu) {
 542                 XMLPropertySet* rp=new XMLPropertySet();
 543                 rp->load(cu,log,this);
 544                 m_credMap[cu->getAttributeNS(NULL,SHIBT_L(Name))]=rp;
 545                 cu=saml::XML::getNextSiblingElement(cu,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(RelyingParty));
 546             }
 547         }
 548
 549         if (conf.isEnabled(ShibTargetConfig::Caching)) {
 550             // Really finally, build local browser profile and binding objects.
 551             m_profile=new ShibBrowserProfile(
 552                 getMetadataProviders(),
 553                 getTrustProviders()
 554                 );
 555             m_bindingHook=new ShibHTTPHook(
 556                 getTrustProviders(),
 557                 creds
 558                 );
 559             m_binding=SAMLBinding::getInstance(SAMLBinding::SOAP);
 560             SAMLSOAPHTTPBinding* bptr=dynamic_cast<SAMLSOAPHTTPBinding*>(m_binding);
 561             if (!bptr) {
 562                 log.fatal("binding implementation was not SOAP over HTTP");
 563                 throw UnsupportedExtensionException("binding implementation was not SOAP over HTTP");
 564             }
 565             bptr->addHook(m_bindingHook,m_bindingHook); // the hook is its own global context
 566         }
 567     }
 568     catch (SAMLException& e) {
 569         log.errorStream() << "Error while processing applicaton element: " << e.what() << CategoryStream::ENDLINE;
 570         cleanup();
 571         throw;
 572     }
 573 #ifndef _DEBUG
 574     catch (...) {
 575         log.error("Unexpected error while processing application element");
 576         cleanup();
 577         throw;
 578     }
 579 #endif
 580 }
 581
 582 void XMLApplication::cleanup()
 583 {
 584     delete m_bindingHook;
 585     delete m_binding;
 586     delete m_profile;
 587     map<string,XMLPropertySet*>::iterator h=m_handlerMap.begin();
 588     while (h!=m_handlerMap.end()) {
 589         delete h->second;
 590         h++;
 591     }
 592     delete m_credDefault;
 593 #ifdef HAVE_GOOD_STL
 594     map<xstring,XMLPropertySet*>::iterator c=m_credMap.begin();
 595 #else
 596     map<const XMLCh*,XMLPropertySet*>::iterator c=m_credMap.begin();
 597 #endif
 598     while (c!=m_credMap.end()) {
 599         delete c->second;
 600         c++;
 601     }
 602     Iterator<SAMLAttributeDesignator*> i(m_designators);
 603     while (i.hasNext())
 604         delete i.next();
 605     Iterator<IAAP*> j(m_aaps);
 606     while (j.hasNext())
 607         delete j.next();
 608     Iterator<IMetadata*> k(m_metadatas);
 609     while (k.hasNext())
 610         delete k.next();
 611     Iterator<ITrust*> l(m_trusts);
 612     while (l.hasNext())
 613         delete l.next();
 614 }
 615
 616 short XMLApplication::acceptNode(const DOMNode* node) const
 617 {
 618     if (saml::XML::isElementNamed(static_cast<const DOMElement*>(node),saml::XML::SAML_NS,L(AttributeDesignator)))
 619         return FILTER_REJECT;
 620     else if (saml::XML::isElementNamed(static_cast<const DOMElement*>(node),saml::XML::SAML_NS,L(Audience)))
 621         return FILTER_REJECT;
 622     const XMLCh* name=node->getLocalName();
 623     if (!XMLString::compareString(name,SHIBT_L(Application)) ||
 624         !XMLString::compareString(name,SHIBT_L(AssertionConsumerService)) ||
 625         !XMLString::compareString(name,SHIBT_L(SingleLogoutService)) ||
 626         !XMLString::compareString(name,SHIBT_L(DiagnosticService)) ||
 627         !XMLString::compareString(name,SHIBT_L(SessionInitiator)) ||
 628         !XMLString::compareString(name,SHIBT_L(AAPProvider)) ||
 629         !XMLString::compareString(name,SHIBT_L(CredentialUse)) ||
 630         !XMLString::compareString(name,SHIBT_L(RelyingParty)) ||
 631         !XMLString::compareString(name,SHIBT_L(FederationProvider)) ||
 632         !XMLString::compareString(name,SHIBT_L(MetadataProvider)) ||
 633         !XMLString::compareString(name,SHIBT_L(TrustProvider)))
 634         return FILTER_REJECT;
 635
 636     return FILTER_ACCEPT;
 637 }
 638
 639 pair<bool,bool> XMLApplication::getBool(const char* name, const char* ns) const
 640 {
 641     pair<bool,bool> ret=XMLPropertySet::getBool(name,ns);
 642     if (ret.first)
 643         return ret;
 644     return m_base ? m_base->getBool(name,ns) : ret;
 645 }
 646
 647 pair<bool,const char*> XMLApplication::getString(const char* name, const char* ns) const
 648 {
 649     pair<bool,const char*> ret=XMLPropertySet::getString(name,ns);
 650     if (ret.first)
 651         return ret;
 652     return m_base ? m_base->getString(name,ns) : ret;
 653 }
 654
 655 pair<bool,const XMLCh*> XMLApplication::getXMLString(const char* name, const char* ns) const
 656 {
 657     pair<bool,const XMLCh*> ret=XMLPropertySet::getXMLString(name,ns);
 658     if (ret.first)
 659         return ret;
 660     return m_base ? m_base->getXMLString(name,ns) : ret;
 661 }
 662
 663 pair<bool,unsigned int> XMLApplication::getUnsignedInt(const char* name, const char* ns) const
 664 {
 665     pair<bool,unsigned int> ret=XMLPropertySet::getUnsignedInt(name,ns);
 666     if (ret.first)
 667         return ret;
 668     return m_base ? m_base->getUnsignedInt(name,ns) : ret;
 669 }
 670
 671 pair<bool,int> XMLApplication::getInt(const char* name, const char* ns) const
 672 {
 673     pair<bool,int> ret=XMLPropertySet::getInt(name,ns);
 674     if (ret.first)
 675         return ret;
 676     return m_base ? m_base->getInt(name,ns) : ret;
 677 }
 678
 679 const IPropertySet* XMLApplication::getPropertySet(const char* name, const char* ns) const
 680 {
 681     const IPropertySet* ret=XMLPropertySet::getPropertySet(name,ns);
 682     if (ret || !m_base)
 683         return ret;
 684     return m_base->getPropertySet(name,ns);
 685 }
 686
 687 Iterator<SAMLAttributeDesignator*> XMLApplication::getAttributeDesignators() const
 688 {
 689     if (!m_designators.empty() || !m_base)
 690         return m_designators;
 691     return m_base->getAttributeDesignators();
 692 }
 693
 694 Iterator<IAAP*> XMLApplication::getAAPProviders() const
 695 {
 696     return (m_aaps.empty() && m_base) ? m_base->getAAPProviders() : m_aaps;
 697 }
 698
 699 Iterator<IMetadata*> XMLApplication::getMetadataProviders() const
 700 {
 701     return (m_metadatas.empty() && m_base) ? m_base->getMetadataProviders() : m_metadatas;
 702 }
 703
 704 Iterator<ITrust*> XMLApplication::getTrustProviders() const
 705 {
 706     return (m_trusts.empty() && m_base) ? m_base->getTrustProviders() : m_trusts;
 707 }
 708
 709 Iterator<const XMLCh*> XMLApplication::getAudiences() const
 710 {
 711     return (m_audiences.empty() && m_base) ? m_base->getAudiences() : m_audiences;
 712 }
 713
 714 const IPropertySet* XMLApplication::getCredentialUse(const IEntityDescriptor* provider) const
 715 {
 716     if (!m_credDefault && m_base)
 717         return m_base->getCredentialUse(provider);
 718
 719 #ifdef HAVE_GOOD_STL
 720     map<xstring,XMLPropertySet*>::const_iterator i=m_credMap.find(provider->getId());
 721     if (i!=m_credMap.end())
 722         return i->second;
 723     const IEntitiesDescriptor* group=provider->getEntitiesDescriptor();
 724     while (group) {
 725         if (group->getName()) {
 726             i=m_credMap.find(group->getName());
 727             if (i!=m_credMap.end())
 728                 return i->second;
 729         }
 730         group=group->getEntitiesDescriptor();
 731     }
 732 #else
 733     map<const XMLCh*,XMLPropertySet*>::const_iterator i=m_credMap.begin();
 734     for (; i!=m_credMap.end(); i++) {
 735         if (!XMLString::compareString(i->first,provider->getId()))
 736             return i->second;
 737         const IEntitiesDescriptor* group=provider->getEntitiesDescriptor();
 738         while (group) {
 739             if (!XMLString::compareString(i->first,group->getName()))
 740                 return i->second;
 741             group=group->getEntitiesDescriptor();
 742         }
 743     }
 744 #endif
 745     return m_credDefault;
 746 }
 747
 748 const IPropertySet* XMLApplication::getDefaultSessionInitiator() const
 749 {
 750     if (m_sessionInitDefault) return m_sessionInitDefault;
 751     return m_base ? m_base->getDefaultSessionInitiator() : NULL;
 752 }
 753
 754 const IPropertySet* XMLApplication::getSessionInitiatorById(const char* id) const
 755 {
 756     map<string,const IPropertySet*>::const_iterator i=m_sessionInitMap.find(id);
 757     if (i!=m_sessionInitMap.end()) return i->second;
 758     return m_base ? m_base->getSessionInitiatorById(id) : NULL;
 759 }
 760
 761 const IPropertySet* XMLApplication::getDefaultAssertionConsumerService() const
 762 {
 763     if (m_acsDefault) return m_acsDefault;
 764     return m_base ? m_base->getDefaultAssertionConsumerService() : NULL;
 765 }
 766
 767 const IPropertySet* XMLApplication::getAssertionConsumerServiceByIndex(unsigned short index) const
 768 {
 769     map<unsigned int,const IPropertySet*>::const_iterator i=m_acsMap.find(index);
 770     if (i!=m_acsMap.end()) return i->second;
 771     return m_base ? m_base->getAssertionConsumerServiceByIndex(index) : NULL;
 772 }
 773
 774 const IPropertySet* XMLApplication::getHandlerConfig(const char* path) const
 775 {
 776     string wrap(path);
 777     map<string,XMLPropertySet*>::const_iterator i=m_handlerMap.find(wrap.substr(0,wrap.find('?')));
 778     if (i!=m_handlerMap.end())
 779         return i->second;
 780     return m_base ? m_base->getHandlerConfig(path) : NULL;
 781 }
 782
 783 ReloadableXMLFileImpl* XMLConfig::newImplementation(const char* pathname, bool first) const
 784 {
 785     return new XMLConfigImpl(pathname,first,this);
 786 }
 787
 788 ReloadableXMLFileImpl* XMLConfig::newImplementation(const DOMElement* e, bool first) const
 789 {
 790     return new XMLConfigImpl(e,first,this);
 791 }
 792
 793 short XMLConfigImpl::acceptNode(const DOMNode* node) const
 794 {
 795     if (XMLString::compareString(node->getNamespaceURI(),shibtarget::XML::SHIBTARGET_NS))
 796         return FILTER_ACCEPT;
 797     const XMLCh* name=node->getLocalName();
 798     if (!XMLString::compareString(name,SHIBT_L(Applications)) ||
 799         !XMLString::compareString(name,SHIBT_L(AttributeFactory)) ||
 800         !XMLString::compareString(name,SHIBT_L(CredentialsProvider)) ||
 801         !XMLString::compareString(name,SHIBT_L(Extensions)) ||
 802         !XMLString::compareString(name,SHIBT_L(Implementation)) ||
 803         !XMLString::compareString(name,SHIBT_L(Listener)) ||
 804         !XMLString::compareString(name,SHIBT_L(MemorySessionCache)) ||
 805         !XMLString::compareString(name,SHIBT_L(MySQLReplayCache)) ||
 806         !XMLString::compareString(name,SHIBT_L(MySQLSessionCache)) ||
 807         !XMLString::compareString(name,SHIBT_L(RequestMap)) ||
 808         !XMLString::compareString(name,SHIBT_L(RequestMapProvider)) ||
 809         !XMLString::compareString(name,SHIBT_L(ReplayCache)) ||
 810         !XMLString::compareString(name,SHIBT_L(SessionCache)) ||
 811         !XMLString::compareString(name,SHIBT_L(TCPListener)) ||
 812         !XMLString::compareString(name,SHIBT_L(UnixListener)))
 813         return FILTER_REJECT;
 814
 815     return FILTER_ACCEPT;
 816 }
 817
 818 void XMLConfigImpl::init(bool first)
 819 {
 820 #ifdef _DEBUG
 821     saml::NDC ndc("init");
 822 #endif
 823     Category& log=Category::getInstance("shibtarget.Config");
 824
 825     try {
 826         if (!saml::XML::isElementNamed(ReloadableXMLFileImpl::m_root,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(ShibbolethTargetConfig)) &&
 827             !saml::XML::isElementNamed(ReloadableXMLFileImpl::m_root,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(SPConfig))) {
 828             log.error("Construction requires a valid configuration file: (conf:SPConfig as root element)");
 829             throw ConfigurationException("Construction requires a valid configuration file: (conf:SPConfig as root element)");
 830         }
 831
 832         SAMLConfig& shibConf=SAMLConfig::getConfig();
 833         ShibTargetConfig& conf=ShibTargetConfig::getConfig();
 834         const DOMElement* SHAR=saml::XML::getFirstChildElement(ReloadableXMLFileImpl::m_root,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(SHAR));
 835         if (!SHAR)
 836             SHAR=saml::XML::getFirstChildElement(ReloadableXMLFileImpl::m_root,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(Global));
 837         const DOMElement* SHIRE=saml::XML::getFirstChildElement(ReloadableXMLFileImpl::m_root,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(SHIRE));
 838         if (!SHIRE)
 839             SHIRE=saml::XML::getFirstChildElement(ReloadableXMLFileImpl::m_root,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(Local));
 840
 841         // Initialize log4cpp manually in order to redirect log messages as soon as possible.
 842         if (conf.isEnabled(ShibTargetConfig::Logging)) {
 843             const XMLCh* logger=NULL;
 844             if (conf.isEnabled(ShibTargetConfig::GlobalExtensions))
 845                 logger=SHAR->getAttributeNS(NULL,SHIBT_L(logger));
 846             else if (conf.isEnabled(ShibTargetConfig::LocalExtensions))
 847                 logger=SHIRE->getAttributeNS(NULL,SHIBT_L(logger));
 848             if (!logger || !*logger)
 849                 logger=ReloadableXMLFileImpl::m_root->getAttributeNS(NULL,SHIBT_L(logger));
 850             if (logger && *logger) {
 851                 auto_ptr_char logpath(logger);
 852                 cerr << "loading new logging configuration from " << logpath.get() << "\n";
 853                 try {
 854                     PropertyConfigurator::configure(logpath.get());
 855                     cerr << "New logging configuration loaded, check log destination for process status..." << "\n";
 856                 }
 857                 catch (ConfigureFailure& e) {
 858                     cerr << "Error reading logging configuration: " << e.what() << "\n";
 859                 }
 860             }
 861         }
 862
 863         // First load any property sets.
 864         map<string,string> root_remap;
 865         root_remap["SHAR"]="Global";
 866         root_remap["SHIRE"]="Local";
 867         load(ReloadableXMLFileImpl::m_root,log,this,&root_remap);
 868
 869         // Much of the processing can only occur on the first instantiation.
 870         if (first) {
 871             // Now load any extensions to insure any needed plugins are registered.
 872             DOMElement* exts=
 873                 saml::XML::getFirstChildElement(ReloadableXMLFileImpl::m_root,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(Extensions));
 874             if (exts) {
 875                 exts=saml::XML::getFirstChildElement(exts,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(Library));
 876                 while (exts) {
 877                     auto_ptr_char path(exts->getAttributeNS(NULL,SHIBT_L(path)));
 878                     try {
 879                         SAMLConfig::getConfig().saml_register_extension(path.get(),exts);
 880                         log.debug("loaded global extension library %s",path.get());
 881                     }
 882                     catch (SAMLException& e) {
 883                         const XMLCh* fatal=exts->getAttributeNS(NULL,SHIBT_L(fatal));
 884                         if (fatal && (*fatal==chLatin_t || *fatal==chDigit_1)) {
 885                             log.fatal("unable to load mandatory global extension library %s: %s", path.get(), e.what());
 886                             throw;
 887                         }
 888                         else
 889                             log.crit("unable to load optional global extension library %s: %s", path.get(), e.what());
 890                     }
 891                     exts=saml::XML::getNextSiblingElement(exts,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(Library));
 892                 }
 893             }
 894
 895             if (conf.isEnabled(ShibTargetConfig::GlobalExtensions)) {
 896                 exts=saml::XML::getFirstChildElement(SHAR,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(Extensions));
 897                 if (exts) {
 898                     exts=saml::XML::getFirstChildElement(exts,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(Library));
 899                     while (exts) {
 900                         auto_ptr_char path(exts->getAttributeNS(NULL,SHIBT_L(path)));
 901                         try {
 902                             SAMLConfig::getConfig().saml_register_extension(path.get(),exts);
 903                             log.debug("loaded Global extension library %s",path.get());
 904                         }
 905                         catch (SAMLException& e) {
 906                             const XMLCh* fatal=exts->getAttributeNS(NULL,SHIBT_L(fatal));
 907                             if (fatal && (*fatal==chLatin_t || *fatal==chDigit_1)) {
 908                                 log.fatal("unable to load mandatory Global extension library %s: %s", path.get(), e.what());
 909                                 throw;
 910                             }
 911                             else
 912                                 log.crit("unable to load optional Global extension library %s: %s", path.get(), e.what());
 913                         }
 914                         exts=saml::XML::getNextSiblingElement(exts,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(Library));
 915                     }
 916                 }
 917             }
 918
 919             if (conf.isEnabled(ShibTargetConfig::LocalExtensions)) {
 920                 exts=saml::XML::getFirstChildElement(SHIRE,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(Extensions));
 921                 if (exts) {
 922                     exts=saml::XML::getFirstChildElement(exts,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(Library));
 923                     while (exts) {
 924                         auto_ptr_char path(exts->getAttributeNS(NULL,SHIBT_L(path)));
 925                         try {
 926                             SAMLConfig::getConfig().saml_register_extension(path.get(),exts);
 927                             log.debug("loaded Local extension library %s",path.get());
 928                         }
 929                         catch (SAMLException& e) {
 930                             const XMLCh* fatal=exts->getAttributeNS(NULL,SHIBT_L(fatal));
 931                             if (fatal && (*fatal==chLatin_t || *fatal==chDigit_1)) {
 932                                 log.fatal("unable to load mandatory Local extension library %s: %s", path.get(), e.what());
 933                                 throw;
 934                             }
 935                             else
 936                                 log.crit("unable to load optional Local extension library %s: %s", path.get(), e.what());
 937                         }
 938                         exts=saml::XML::getNextSiblingElement(exts,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(Library));
 939                     }
 940                 }
 941             }
 942
 943             // Instantiate the Listener and SessionCache objects.
 944             if (conf.isEnabled(ShibTargetConfig::Listener)) {
 945                 IPlugIn* plugin=NULL;
 946                 exts=saml::XML::getFirstChildElement(SHAR,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(UnixListener));
 947                 if (exts) {
 948                     log.info("building Listener of type %s...",shibtarget::XML::UnixListenerType);
 949                     plugin=shibConf.getPlugMgr().newPlugin(shibtarget::XML::UnixListenerType,exts);
 950                 }
 951                 else {
 952                     exts=saml::XML::getFirstChildElement(SHAR,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(TCPListener));
 953                     if (exts) {
 954                         log.info("building Listener of type %s...",shibtarget::XML::TCPListenerType);
 955                         plugin=shibConf.getPlugMgr().newPlugin(shibtarget::XML::TCPListenerType,exts);
 956                     }
 957                     else {
 958                         exts=saml::XML::getFirstChildElement(SHAR,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(Listener));
 959                         if (exts) {
 960                             auto_ptr_char type(exts->getAttributeNS(NULL,SHIBT_L(type)));
 961                             log.info("building Listener of type %s...",type.get());
 962                             plugin=shibConf.getPlugMgr().newPlugin(type.get(),exts);
 963                         }
 964                         else {
 965                             log.fatal("can't build Listener object, missing conf:Listener element?");
 966                             throw ConfigurationException("can't build Listener object, missing conf:Listener element?");
 967                         }
 968                     }
 969                 }
 970                 if (plugin) {
 971                     IListener* listen=dynamic_cast<IListener*>(plugin);
 972                     if (listen)
 973                         m_outer->m_listener=listen;
 974                     else {
 975                         delete plugin;
 976                         log.fatal("plugin was not a Listener object");
 977                         throw UnsupportedExtensionException("plugin was not a Listener object");
 978                     }
 979                 }
 980             }
 981
 982             if (conf.isEnabled(ShibTargetConfig::Caching)) {
 983                 IPlugIn* plugin=NULL;
 984                 exts=saml::XML::getFirstChildElement(SHAR,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(MemorySessionCache));
 985                 if (exts) {
 986                     log.info("building Session Cache of type %s...",shibtarget::XML::MemorySessionCacheType);
 987                     plugin=shibConf.getPlugMgr().newPlugin(shibtarget::XML::MemorySessionCacheType,exts);
 988                 }
 989                 else {
 990                     exts=saml::XML::getFirstChildElement(SHAR,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(MySQLSessionCache));
 991                     if (exts) {
 992                         log.info("building Session Cache of type %s...",shibtarget::XML::MySQLSessionCacheType);
 993                         plugin=shibConf.getPlugMgr().newPlugin(shibtarget::XML::MySQLSessionCacheType,exts);
 994                     }
 995                     else {
 996                         exts=saml::XML::getFirstChildElement(SHAR,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(SessionCache));
 997                         if (exts) {
 998                             auto_ptr_char type(exts->getAttributeNS(NULL,SHIBT_L(type)));
 999                             log.info("building Session Cache of type %s...",type.get());
1000                             plugin=shibConf.getPlugMgr().newPlugin(type.get(),exts);
1001                         }
1002                         else {
1003                             log.fatal("can't build Session Cache object, missing conf:SessionCache element?");
1004                             throw ConfigurationException("can't build Session Cache object, missing conf:SessionCache element?");
1005                         }
1006                     }
1007                 }
1008                 if (plugin) {
1009                     ISessionCache* cache=dynamic_cast<ISessionCache*>(plugin);
1010                     if (cache)
1011                         m_outer->m_sessionCache=cache;
1012                     else {
1013                         delete plugin;
1014                         log.fatal("plugin was not a Session Cache object");
1015                         throw UnsupportedExtensionException("plugin was not a Session Cache object");
1016                     }
1017                 }
1018
1019                 // Replay cache.
1020                 exts=saml::XML::getFirstChildElement(SHAR,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(MySQLReplayCache));
1021                 if (exts) {
1022                     log.info("building Replay Cache of type %s...",shibtarget::XML::MySQLReplayCacheType);
1023                     m_outer->m_replayCache=IReplayCache::getInstance(shibtarget::XML::MySQLReplayCacheType,exts);
1024                 }
1025                 else {
1026                     exts=saml::XML::getFirstChildElement(SHAR,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(ReplayCache));
1027                     if (exts) {
1028                         auto_ptr_char type(exts->getAttributeNS(NULL,SHIBT_L(type)));
1029                         log.info("building Replay Cache of type %s...",type.get());
1030                         m_outer->m_replayCache=IReplayCache::getInstance(type.get(),exts);
1031                     }
1032                     else {
1033                         // OpenSAML default provider.
1034                         log.info("building default Replay Cache...");
1035                         m_outer->m_replayCache=IReplayCache::getInstance();
1036                     }
1037                 }
1038             }
1039         }
1040
1041         // Back to the fully dynamic stuff...next up is the Request Mapper.
1042         if (conf.isEnabled(ShibTargetConfig::RequestMapper)) {
1043             const DOMElement* child=saml::XML::getFirstChildElement(SHIRE,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(RequestMapProvider));
1044             if (child) {
1045                 auto_ptr_char type(child->getAttributeNS(NULL,SHIBT_L(type)));
1046                 log.info("building Request Mapper of type %s...",type.get());
1047                 IPlugIn* plugin=shibConf.getPlugMgr().newPlugin(type.get(),child);
1048                 if (plugin) {
1049                     IRequestMapper* reqmap=dynamic_cast<IRequestMapper*>(plugin);
1050                     if (reqmap)
1051                         m_requestMapper=reqmap;
1052                     else {
1053                         delete plugin;
1054                         log.fatal("plugin was not a Request Mapper object");
1055                         throw UnsupportedExtensionException("plugin was not a Request Mapper object");
1056                     }
1057                 }
1058             }
1059             else {
1060                 log.fatal("can't build Request Mapper object, missing conf:RequestMapProvider element?");
1061                 throw ConfigurationException("can't build Request Mapper object, missing conf:RequestMapProvider element?");
1062             }
1063         }
1064
1065         // Now we load any credentials providers.
1066         DOMNodeList* nlist;
1067         if (conf.isEnabled(ShibTargetConfig::Credentials)) {
1068             nlist=ReloadableXMLFileImpl::m_root->getElementsByTagNameNS(shibtarget::XML::SHIBTARGET_NS,SHIBT_L(CredentialsProvider));
1069             for (unsigned int i=0; nlist && i<nlist->getLength(); i++) {
1070                 auto_ptr_char type(static_cast<DOMElement*>(nlist->item(i))->getAttributeNS(NULL,SHIBT_L(type)));
1071                 log.info("building credentials provider of type %s...",type.get());
1072                 try {
1073                     IPlugIn* plugin=shibConf.getPlugMgr().newPlugin(type.get(),static_cast<DOMElement*>(nlist->item(i)));
1074                     if (plugin) {
1075                         ICredentials* creds=dynamic_cast<ICredentials*>(plugin);
1076                         if (creds)
1077                             m_creds.push_back(creds);
1078                         else {
1079                             delete plugin;
1080                             log.crit("plugin was not a credentials provider");
1081                         }
1082                     }
1083                 }
1084                 catch (SAMLException& ex) {
1085                     log.crit("error building credentials provider: %s",ex.what());
1086                 }
1087             }
1088         }
1089
1090         // Now we load any attribute factories
1091         nlist=ReloadableXMLFileImpl::m_root->getElementsByTagNameNS(shibtarget::XML::SHIBTARGET_NS,SHIBT_L(AttributeFactory));
1092         for (unsigned int i=0; nlist && i<nlist->getLength(); i++) {
1093             auto_ptr_char type(static_cast<DOMElement*>(nlist->item(i))->getAttributeNS(NULL,SHIBT_L(type)));
1094             log.info("building Attribute factory of type %s...",type.get());
1095             try {
1096                 IPlugIn* plugin=shibConf.getPlugMgr().newPlugin(type.get(),static_cast<DOMElement*>(nlist->item(i)));
1097                 if (plugin) {
1098                     IAttributeFactory* fact=dynamic_cast<IAttributeFactory*>(plugin);
1099                     if (fact) {
1100                         m_attrFactories.push_back(fact);
1101                         ShibConfig::getConfig().regAttributeMapping(
1102                             static_cast<DOMElement*>(nlist->item(i))->getAttributeNS(NULL,L(AttributeName)),
1103                             fact
1104                             );
1105                     }
1106                     else {
1107                         delete plugin;
1108                         log.crit("plugin was not an Attribute factory");
1109                     }
1110                 }
1111             }
1112             catch (SAMLException& ex) {
1113                 log.crit("error building Attribute factory: %s",ex.what());
1114             }
1115         }
1116
1117         // Load the default application. This actually has a fixed ID of "default". ;-)
1118         const DOMElement* app=saml::XML::getFirstChildElement(
1119             ReloadableXMLFileImpl::m_root,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(Applications)
1120             );
1121         if (!app) {
1122             log.fatal("can't build default Application object, missing conf:Applications element?");
1123             throw ConfigurationException("can't build default Application object, missing conf:Applications element?");
1124         }
1125         XMLApplication* defapp=new XMLApplication(m_outer, m_creds, app);
1126         m_appmap[defapp->getId()]=defapp;
1127
1128         // Load any overrides.
1129         nlist=app->getElementsByTagNameNS(shibtarget::XML::SHIBTARGET_NS,SHIBT_L(Application));
1130         for (unsigned int j=0; nlist && j<nlist->getLength(); j++) {
1131             XMLApplication* iapp=new XMLApplication(m_outer,m_creds,static_cast<DOMElement*>(nlist->item(j)),defapp);
1132             if (m_appmap.find(iapp->getId())!=m_appmap.end()) {
1133                 log.fatal("found conf:Application element with duplicate Id attribute");
1134                 throw ConfigurationException("found conf:Application element with duplicate Id attribute");
1135             }
1136             m_appmap[iapp->getId()]=iapp;
1137         }
1138     }
1139     catch (SAMLException& e) {
1140         log.errorStream() << "Error while loading SP configuration: " << e.what() << CategoryStream::ENDLINE;
1141         throw;
1142     }
1143 #ifndef _DEBUG
1144     catch (...) {
1145         log.error("Unexpected error while loading SP configuration");
1146         throw;
1147     }
1148 #endif
1149 }
1150
1151 XMLConfigImpl::~XMLConfigImpl()
1152 {
1153     delete m_requestMapper;
1154     for (map<string,IApplication*>::iterator i=m_appmap.begin(); i!=m_appmap.end(); i++)
1155         delete i->second;
1156     for (vector<ICredentials*>::iterator j=m_creds.begin(); j!=m_creds.end(); j++)
1157         delete (*j);
1158     ShibConfig::getConfig().clearAttributeMappings();
1159     for (vector<IAttributeFactory*>::iterator k=m_attrFactories.begin(); k!=m_attrFactories.end(); k++)
1160         delete (*k);
1161 }