shib-target/shib-ini.cpp

   1 /*
   2  * The Shibboleth License, Version 1.
   3  * Copyright (c) 2002
   4  * University Corporation for Advanced Internet Development, Inc.
   5  * All rights reserved
   6  *
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions are met:
  10  *
  11  * Redistributions of source code must retain the above copyright notice, this
  12  * list of conditions and the following disclaimer.
  13  *
  14  * Redistributions in binary form must reproduce the above copyright notice,
  15  * this list of conditions and the following disclaimer in the documentation
  16  * and/or other materials provided with the distribution, if any, must include
  17  * the following acknowledgment: "This product includes software developed by
  18  * the University Corporation for Advanced Internet Development
  19  * <http://www.ucaid.edu>Internet2 Project. Alternately, this acknowledegement
  20  * may appear in the software itself, if and wherever such third-party
  21  * acknowledgments normally appear.
  22  *
  23  * Neither the name of Shibboleth nor the names of its contributors, nor
  24  * Internet2, nor the University Corporation for Advanced Internet Development,
  25  * Inc., nor UCAID may be used to endorse or promote products derived from this
  26  * software without specific prior written permission. For written permission,
  27  * please contact shibboleth@shibboleth.org
  28  *
  29  * Products derived from this software may not be called Shibboleth, Internet2,
  30  * UCAID, or the University Corporation for Advanced Internet Development, nor
  31  * may Shibboleth appear in their name, without prior written permission of the
  32  * University Corporation for Advanced Internet Development.
  33  *
  34  *
  35  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
  36  * AND WITH ALL FAULTS. ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  37  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
  38  * PARTICULAR PURPOSE, AND NON-INFRINGEMENT ARE DISCLAIMED AND THE ENTIRE RISK
  39  * OF SATISFACTORY QUALITY, PERFORMANCE, ACCURACY, AND EFFORT IS WITH LICENSEE.
  40  * IN NO EVENT SHALL THE COPYRIGHT OWNER, CONTRIBUTORS OR THE UNIVERSITY
  41  * CORPORATION FOR ADVANCED INTERNET DEVELOPMENT, INC. BE LIABLE FOR ANY DIRECT,
  42  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
  43  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  44  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
  45  * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  46  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  47  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  48  */
  49
  50 /*
  51  * shib-ini.h -- config file handling, now XML-based
  52  *
  53  * $Id$
  54  */
  55
  56 #include "internal.h"
  57
  58 #include <shib/shib-threads.h>
  59 #include <log4cpp/Category.hh>
  60 #include <log4cpp/PropertyConfigurator.hh>
  61
  62 #include <sys/types.h>
  63 #include <sys/stat.h>
  64
  65 using namespace std;
  66 using namespace saml;
  67 using namespace shibboleth;
  68 using namespace shibtarget;
  69 using namespace log4cpp;
  70
  71 namespace shibtarget {
  72
  73     // Application configuration wrapper
  74     class XMLApplication : public virtual IApplication, public XMLPropertySet, public DOMNodeFilter
  75     {
  76     public:
  77         XMLApplication(const IConfig*, const Iterator<ICredentials*>& creds, const DOMElement* e, const XMLApplication* base=NULL);
  78         ~XMLApplication() { cleanup(); }
  79
  80         // IPropertySet
  81         pair<bool,bool> getBool(const char* name, const char* ns=NULL) const;
  82         pair<bool,const char*> getString(const char* name, const char* ns=NULL) const;
  83         pair<bool,const XMLCh*> getXMLString(const char* name, const char* ns=NULL) const;
  84         pair<bool,unsigned int> getUnsignedInt(const char* name, const char* ns=NULL) const;
  85         pair<bool,int> getInt(const char* name, const char* ns=NULL) const;
  86         const IPropertySet* getPropertySet(const char* name, const char* ns="urn:mace:shibboleth:target:config:1.0") const;
  87
  88         // IApplication
  89         const char* getId() const {return getString("id").second;}
  90         Iterator<SAMLAttributeDesignator*> getAttributeDesignators() const;
  91         Iterator<IAAP*> getAAPProviders() const;
  92         Iterator<IMetadata*> getMetadataProviders() const;
  93         Iterator<ITrust*> getTrustProviders() const;
  94         Iterator<IRevocation*> getRevocationProviders() const;
  95         Iterator<const XMLCh*> getAudiences() const;
  96         const IPropertySet* getCredentialUse(const IEntityDescriptor* provider) const;
  97         const SAMLBrowserProfile* getBrowserProfile() const {return m_profile;}
  98         const SAMLBinding* getBinding(const XMLCh* binding) const
  99             {return XMLString::compareString(SAMLBinding::SOAP,binding) ? NULL : m_binding;}
 100         SAMLBrowserProfile::ArtifactMapper* getArtifactMapper() const {return new STArtifactMapper(this);}
 101
 102         // Provides filter to exclude special config elements.
 103         short acceptNode(const DOMNode* node) const;
 104
 105     private:
 106         void cleanup();
 107         const IConfig* m_ini;   // this is ok because its locking scope includes us
 108         const XMLApplication* m_base;
 109         vector<SAMLAttributeDesignator*> m_designators;
 110         vector<IAAP*> m_aaps;
 111         vector<IMetadata*> m_metadatas;
 112         vector<ITrust*> m_trusts;
 113         vector<IRevocation*> m_revocations;
 114         vector<const XMLCh*> m_audiences;
 115         ShibBrowserProfile* m_profile;
 116         SAMLBinding* m_binding;
 117         ShibHTTPHook* m_bindingHook;
 118         XMLPropertySet* m_credDefault;
 119 #ifdef HAVE_GOOD_STL
 120         map<xstring,XMLPropertySet*> m_credMap;
 121 #else
 122         map<const XMLCh*,XMLPropertySet*> m_credMap;
 123 #endif
 124     };
 125
 126     // Top-level configuration implementation
 127     class XMLConfig;
 128     class XMLConfigImpl : public ReloadableXMLFileImpl, public XMLPropertySet, public DOMNodeFilter
 129     {
 130     public:
 131         XMLConfigImpl(const char* pathname, bool first, const XMLConfig* outer)
 132             : ReloadableXMLFileImpl(pathname), m_outer(outer), m_requestMapper(NULL) { init(first); }
 133         XMLConfigImpl(const DOMElement* e, bool first, const XMLConfig* outer)
 134             : ReloadableXMLFileImpl(e), m_outer(outer), m_requestMapper(NULL) { init(first); }
 135         ~XMLConfigImpl();
 136
 137         IRequestMapper* m_requestMapper;
 138         map<string,IApplication*> m_appmap;
 139         vector<ICredentials*> m_creds;
 140
 141         // Provides filter to exclude special config elements.
 142         short acceptNode(const DOMNode* node) const;
 143
 144     private:
 145         void init(bool first);
 146         const XMLConfig* m_outer;
 147     };
 148
 149     class XMLConfig : public IConfig, public ReloadableXMLFile
 150     {
 151     public:
 152         XMLConfig(const DOMElement* e) : ReloadableXMLFile(e), m_listener(NULL), m_sessionCache(NULL), m_replayCache(NULL) {}
 153         ~XMLConfig() {delete m_listener; delete m_sessionCache; delete m_replayCache;}
 154
 155         // IPropertySet
 156         pair<bool,bool> getBool(const char* name, const char* ns=NULL) const {return static_cast<XMLConfigImpl*>(m_impl)->getBool(name,ns);}
 157         pair<bool,const char*> getString(const char* name, const char* ns=NULL) const {return static_cast<XMLConfigImpl*>(m_impl)->getString(name,ns);}
 158         pair<bool,const XMLCh*> getXMLString(const char* name, const char* ns=NULL) const {return static_cast<XMLConfigImpl*>(m_impl)->getXMLString(name,ns);}
 159         pair<bool,unsigned int> getUnsignedInt(const char* name, const char* ns=NULL) const {return static_cast<XMLConfigImpl*>(m_impl)->getUnsignedInt(name,ns);}
 160         pair<bool,int> getInt(const char* name, const char* ns=NULL) const {return static_cast<XMLConfigImpl*>(m_impl)->getInt(name,ns);}
 161         const IPropertySet* getPropertySet(const char* name, const char* ns="urn:mace:shibboleth:target:config:1.0") const {return static_cast<XMLConfigImpl*>(m_impl)->getPropertySet(name,ns);}
 162         const DOMElement* getElement() const {return static_cast<XMLConfigImpl*>(m_impl)->getElement();}
 163
 164         // IConfig
 165         const IListener* getListener() const {return m_listener;}
 166         ISessionCache* getSessionCache() const {return m_sessionCache;}
 167         IReplayCache* getReplayCache() const {return m_replayCache;}
 168         IRequestMapper* getRequestMapper() const {return static_cast<XMLConfigImpl*>(m_impl)->m_requestMapper;}
 169         const IApplication* getApplication(const char* applicationId) const
 170         {
 171             map<string,IApplication*>::const_iterator i=static_cast<XMLConfigImpl*>(m_impl)->m_appmap.find(applicationId);
 172             return (i!=static_cast<XMLConfigImpl*>(m_impl)->m_appmap.end()) ? i->second : NULL;
 173         }
 174         Iterator<ICredentials*> getCredentialsProviders() const {return static_cast<XMLConfigImpl*>(m_impl)->m_creds;}
 175
 176     protected:
 177         virtual ReloadableXMLFileImpl* newImplementation(const char* pathname, bool first=true) const;
 178         virtual ReloadableXMLFileImpl* newImplementation(const DOMElement* e, bool first=true) const;
 179
 180     private:
 181         friend class XMLConfigImpl;
 182         mutable IListener* m_listener;
 183         mutable ISessionCache* m_sessionCache;
 184         mutable IReplayCache* m_replayCache;
 185     };
 186 }
 187
 188 IConfig* STConfig::ShibTargetConfigFactory(const DOMElement* e)
 189 {
 190     auto_ptr<XMLConfig> ret(new XMLConfig(e));
 191     ret->getImplementation();
 192     return ret.release();
 193 }
 194
 195 XMLPropertySet::~XMLPropertySet()
 196 {
 197     for (map<string,pair<char*,const XMLCh*> >::iterator i=m_map.begin(); i!=m_map.end(); i++)
 198         XMLString::release(&(i->second.first));
 199     for (map<string,IPropertySet*>::iterator j=m_nested.begin(); j!=m_nested.end(); j++)
 200         delete j->second;
 201 }
 202
 203 void XMLPropertySet::load(
 204     const DOMElement* e,
 205     Category& log,
 206     DOMNodeFilter* filter,
 207     const std::map<std::string,std::string>* remapper
 208     )
 209 {
 210 #ifdef _DEBUG
 211     saml::NDC ndc("load");
 212 #endif
 213     m_root=e;
 214
 215     // Process each attribute as a property.
 216     DOMNamedNodeMap* attrs=m_root->getAttributes();
 217     for (XMLSize_t i=0; i<attrs->getLength(); i++) {
 218         DOMNode* a=attrs->item(i);
 219         if (!XMLString::compareString(a->getNamespaceURI(),saml::XML::XMLNS_NS))
 220             continue;
 221         char* val=XMLString::transcode(a->getNodeValue());
 222         if (val && *val) {
 223             auto_ptr_char ns(a->getNamespaceURI());
 224             auto_ptr_char name(a->getLocalName());
 225             const char* realname=name.get();
 226             if (remapper) {
 227                 map<string,string>::const_iterator remap=remapper->find(realname);
 228                 if (remap!=remapper->end()) {
 229                     log.debug("remapping property (%s) to (%s)",realname,remap->second.c_str());
 230                     realname=remap->second.c_str();
 231                 }
 232             }
 233             if (ns.get()) {
 234                 m_map[string("{") + ns.get() + '}' + realname]=pair<char*,const XMLCh*>(val,a->getNodeValue());
 235                 log.debug("added property {%s}%s (%s)",ns.get(),realname,val);
 236             }
 237             else {
 238                 m_map[realname]=pair<char*,const XMLCh*>(val,a->getNodeValue());
 239                 log.debug("added property %s (%s)",realname,val);
 240             }
 241         }
 242     }
 243
 244     // Process non-excluded elements as nested sets.
 245     DOMTreeWalker* walker=
 246         static_cast<DOMDocumentTraversal*>(
 247             m_root->getOwnerDocument())->createTreeWalker(const_cast<DOMElement*>(m_root),DOMNodeFilter::SHOW_ELEMENT,filter,false
 248             );
 249     e=static_cast<DOMElement*>(walker->firstChild());
 250     while (e) {
 251         auto_ptr_char ns(e->getNamespaceURI());
 252         auto_ptr_char name(e->getLocalName());
 253         const char* realname=name.get();
 254         if (remapper) {
 255             map<string,string>::const_iterator remap=remapper->find(realname);
 256             if (remap!=remapper->end()) {
 257                 log.debug("remapping property set (%s) to (%s)",realname,remap->second.c_str());
 258                 realname=remap->second.c_str();
 259             }
 260         }
 261         string key;
 262         if (ns.get())
 263             key=string("{") + ns.get() + '}' + realname;
 264         else
 265             key=realname;
 266         if (m_nested.find(key)!=m_nested.end())
 267             log.warn("load() skipping duplicate property set: %s",key.c_str());
 268         else {
 269             XMLPropertySet* set=new XMLPropertySet();
 270             set->load(e,log,filter,remapper);
 271             m_nested[key]=set;
 272             log.debug("added nested property set: %s",key.c_str());
 273         }
 274         e=static_cast<DOMElement*>(walker->nextSibling());
 275     }
 276     walker->release();
 277 }
 278
 279 pair<bool,bool> XMLPropertySet::getBool(const char* name, const char* ns) const
 280 {
 281     pair<bool,bool> ret=pair<bool,bool>(false,false);
 282     map<string,pair<char*,const XMLCh*> >::const_iterator i;
 283
 284     if (ns)
 285         i=m_map.find(string("{") + ns + '}' + name);
 286     else
 287         i=m_map.find(name);
 288
 289     if (i!=m_map.end()) {
 290         ret.first=true;
 291         ret.second=(!strcmp(i->second.first,"true") || !strcmp(i->second.first,"1"));
 292     }
 293     return ret;
 294 }
 295
 296 pair<bool,const char*> XMLPropertySet::getString(const char* name, const char* ns) const
 297 {
 298     pair<bool,const char*> ret=pair<bool,const char*>(false,NULL);
 299     map<string,pair<char*,const XMLCh*> >::const_iterator i;
 300
 301     if (ns)
 302         i=m_map.find(string("{") + ns + '}' + name);
 303     else
 304         i=m_map.find(name);
 305
 306     if (i!=m_map.end()) {
 307         ret.first=true;
 308         ret.second=i->second.first;
 309     }
 310     return ret;
 311 }
 312
 313 pair<bool,const XMLCh*> XMLPropertySet::getXMLString(const char* name, const char* ns) const
 314 {
 315     pair<bool,const XMLCh*> ret=pair<bool,const XMLCh*>(false,NULL);
 316     map<string,pair<char*,const XMLCh*> >::const_iterator i;
 317
 318     if (ns)
 319         i=m_map.find(string("{") + ns + '}' + name);
 320     else
 321         i=m_map.find(name);
 322
 323     if (i!=m_map.end()) {
 324         ret.first=true;
 325         ret.second=i->second.second;
 326     }
 327     return ret;
 328 }
 329
 330 pair<bool,unsigned int> XMLPropertySet::getUnsignedInt(const char* name, const char* ns) const
 331 {
 332     pair<bool,unsigned int> ret=pair<bool,unsigned int>(false,0);
 333     map<string,pair<char*,const XMLCh*> >::const_iterator i;
 334
 335     if (ns)
 336         i=m_map.find(string("{") + ns + '}' + name);
 337     else
 338         i=m_map.find(name);
 339
 340     if (i!=m_map.end()) {
 341         ret.first=true;
 342         ret.second=strtol(i->second.first,NULL,10);
 343     }
 344     return ret;
 345 }
 346
 347 pair<bool,int> XMLPropertySet::getInt(const char* name, const char* ns) const
 348 {
 349     pair<bool,int> ret=pair<bool,int>(false,0);
 350     map<string,pair<char*,const XMLCh*> >::const_iterator i;
 351
 352     if (ns)
 353         i=m_map.find(string("{") + ns + '}' + name);
 354     else
 355         i=m_map.find(name);
 356
 357     if (i!=m_map.end()) {
 358         ret.first=true;
 359         ret.second=atoi(i->second.first);
 360     }
 361     return ret;
 362 }
 363
 364 const IPropertySet* XMLPropertySet::getPropertySet(const char* name, const char* ns) const
 365 {
 366     map<string,IPropertySet*>::const_iterator i;
 367
 368     if (ns)
 369         i=m_nested.find(string("{") + ns + '}' + name);
 370     else
 371         i=m_nested.find(name);
 372
 373     return (i!=m_nested.end()) ? i->second : NULL;
 374 }
 375
 376 XMLApplication::XMLApplication(const IConfig* ini, const Iterator<ICredentials*>& creds, const DOMElement* e, const XMLApplication* base)
 377     : m_ini(ini), m_base(base), m_profile(NULL), m_binding(NULL), m_bindingHook(NULL), m_credDefault(NULL)
 378 {
 379 #ifdef _DEBUG
 380     NDC ndc("XMLApplication");
 381 #endif
 382     Category& log=Category::getInstance("shibtarget.XMLApplication");
 383
 384     try {
 385         // First load any property sets.
 386         map<string,string> root_remap;
 387         root_remap["shire"]="session";
 388         load(e,log,this,&root_remap);
 389         const IPropertySet* propcheck=getPropertySet("Errors");
 390         if (propcheck && !propcheck->getString("session").first)
 391             throw MalformedException("<Errors> element requires 'session' (or deprecated 'shire') attribute");
 392
 393         ShibTargetConfig& conf=ShibTargetConfig::getConfig();
 394         SAMLConfig& shibConf=SAMLConfig::getConfig();
 395         int i;
 396         DOMNodeList* nlist=e->getElementsByTagNameNS(saml::XML::SAML_NS,L(AttributeDesignator));
 397         for (i=0; nlist && i<nlist->getLength(); i++) {
 398             m_designators.push_back(new SAMLAttributeDesignator(static_cast<DOMElement*>(nlist->item(i))));
 399         }
 400
 401         nlist=e->getElementsByTagNameNS(saml::XML::SAML_NS,L(Audience));
 402         for (i=0; nlist && i<nlist->getLength(); i++) {
 403             m_audiences.push_back(nlist->item(i)->getFirstChild()->getNodeValue());
 404         }
 405         // Always include our own providerId as an audience.
 406         m_audiences.push_back(getXMLString("providerId").second);
 407
 408         if (conf.isEnabled(ShibTargetConfig::AAP)) {
 409             nlist=e->getElementsByTagNameNS(ShibTargetConfig::SHIBTARGET_NS,SHIBT_L(AAPProvider));
 410             for (i=0; nlist && i<nlist->getLength(); i++) {
 411                 auto_ptr_char type(static_cast<DOMElement*>(nlist->item(i))->getAttributeNS(NULL,SHIBT_L(type)));
 412                 log.info("building AAP provider of type %s...",type.get());
 413                 IPlugIn* plugin=shibConf.getPlugMgr().newPlugin(type.get(),static_cast<DOMElement*>(nlist->item(i)));
 414                 IAAP* aap=dynamic_cast<IAAP*>(plugin);
 415                 if (aap)
 416                     m_aaps.push_back(aap);
 417                 else {
 418                     delete plugin;
 419                     log.fatal("plugin was not an AAP provider");
 420                     throw UnsupportedExtensionException("plugin was not an AAP provider");
 421                 }
 422             }
 423         }
 424
 425         if (conf.isEnabled(ShibTargetConfig::Metadata)) {
 426             nlist=e->getElementsByTagNameNS(ShibTargetConfig::SHIBTARGET_NS,SHIBT_L(FederationProvider));
 427             for (i=0; nlist && i<nlist->getLength(); i++) {
 428                 auto_ptr_char type(static_cast<DOMElement*>(nlist->item(i))->getAttributeNS(NULL,SHIBT_L(type)));
 429                 log.info("building federation/metadata provider of type %s...",type.get());
 430                 IPlugIn* plugin=shibConf.getPlugMgr().newPlugin(type.get(),static_cast<DOMElement*>(nlist->item(i)));
 431                 IMetadata* md=dynamic_cast<IMetadata*>(plugin);
 432                 if (md)
 433                     m_metadatas.push_back(md);
 434                 else {
 435                     delete plugin;
 436                     log.fatal("plugin was not a federation/metadata provider");
 437                     throw UnsupportedExtensionException("plugin was not a federation/metadata provider");
 438                 }
 439             }
 440         }
 441
 442         if (conf.isEnabled(ShibTargetConfig::Trust)) {
 443             nlist=e->getElementsByTagNameNS(ShibTargetConfig::SHIBTARGET_NS,SHIBT_L(TrustProvider));
 444             for (i=0; nlist && i<nlist->getLength(); i++) {
 445                 auto_ptr_char type(static_cast<DOMElement*>(nlist->item(i))->getAttributeNS(NULL,SHIBT_L(type)));
 446                 log.info("building trust provider of type %s...",type.get());
 447                 IPlugIn* plugin=shibConf.getPlugMgr().newPlugin(type.get(),static_cast<DOMElement*>(nlist->item(i)));
 448                 ITrust* trust=dynamic_cast<ITrust*>(plugin);
 449                 if (trust)
 450                     m_trusts.push_back(trust);
 451                 else {
 452                     delete plugin;
 453                     log.fatal("plugin was not a trust provider");
 454                     throw UnsupportedExtensionException("plugin was not a trust provider");
 455                 }
 456             }
 457             nlist=e->getElementsByTagNameNS(ShibTargetConfig::SHIBTARGET_NS,SHIBT_L(RevocationProvider));
 458             for (i=0; nlist && i<nlist->getLength(); i++) {
 459                 auto_ptr_char type(static_cast<DOMElement*>(nlist->item(i))->getAttributeNS(NULL,SHIBT_L(type)));
 460                 log.info("building revocation provider of type %s...",type.get());
 461                 IPlugIn* plugin=shibConf.getPlugMgr().newPlugin(type.get(),static_cast<DOMElement*>(nlist->item(i)));
 462                 IRevocation* rev=dynamic_cast<IRevocation*>(plugin);
 463                 if (rev)
 464                     m_revocations.push_back(rev);
 465                 else {
 466                     delete plugin;
 467                     log.fatal("plugin was not a revocation provider");
 468                     throw UnsupportedExtensionException("plugin was not a revocation provider");
 469                 }
 470             }
 471         }
 472
 473         // Finally, load credential mappings.
 474         const DOMElement* cu=saml::XML::getFirstChildElement(e,ShibTargetConfig::SHIBTARGET_NS,SHIBT_L(CredentialUse));
 475         if (cu) {
 476             m_credDefault=new XMLPropertySet();
 477             m_credDefault->load(cu,log,this);
 478             cu=saml::XML::getFirstChildElement(cu,ShibTargetConfig::SHIBTARGET_NS,SHIBT_L(RelyingParty));
 479             while (cu) {
 480                 XMLPropertySet* rp=new XMLPropertySet();
 481                 rp->load(cu,log,this);
 482                 m_credMap[cu->getAttributeNS(NULL,SHIBT_L(Name))]=rp;
 483                 cu=saml::XML::getNextSiblingElement(cu,ShibTargetConfig::SHIBTARGET_NS,SHIBT_L(RelyingParty));
 484             }
 485         }
 486
 487         if (conf.isEnabled(ShibTargetConfig::Caching)) {
 488             // Really finally, build local browser profile and binding objects.
 489             m_profile=new ShibBrowserProfile(
 490                 getMetadataProviders(),
 491                 getRevocationProviders(),
 492                 getTrustProviders()
 493                 );
 494             m_bindingHook=new ShibHTTPHook(
 495                 getRevocationProviders(),
 496                 getTrustProviders(),
 497                 creds
 498                 );
 499             m_binding=SAMLBinding::getInstance(SAMLBinding::SOAP);
 500             SAMLSOAPHTTPBinding* bptr=dynamic_cast<SAMLSOAPHTTPBinding*>(m_binding);
 501             if (!bptr) {
 502                 log.fatal("binding implementation was not SOAP over HTTP");
 503                 throw UnsupportedExtensionException("binding implementation was not SOAP over HTTP");
 504             }
 505             bptr->addHook(m_bindingHook,m_bindingHook); // the hook is its own global context
 506         }
 507     }
 508     catch (SAMLException& e) {
 509         log.errorStream() << "Error while processing applicaton element: " << e.what() << CategoryStream::ENDLINE;
 510         cleanup();
 511         throw;
 512     }
 513 #ifndef _DEBUG
 514     catch (...) {
 515         log.error("Unexpected error while processing application element");
 516         cleanup();
 517         throw;
 518     }
 519 #endif
 520 }
 521
 522 void XMLApplication::cleanup()
 523 {
 524     delete m_bindingHook;
 525     delete m_binding;
 526     delete m_profile;
 527     delete m_credDefault;
 528 #ifdef HAVE_GOOD_STL
 529     map<xstring,XMLPropertySet*>::iterator c=m_credMap.begin();
 530 #else
 531     map<const XMLCh*,XMLPropertySet*>::iterator c=m_credMap.begin();
 532 #endif
 533     while (c!=m_credMap.end()) {
 534         delete c->second;
 535         c++;
 536     }
 537     Iterator<SAMLAttributeDesignator*> i(m_designators);
 538     while (i.hasNext())
 539         delete i.next();
 540     Iterator<IAAP*> j(m_aaps);
 541     while (j.hasNext())
 542         delete j.next();
 543     Iterator<IMetadata*> k(m_metadatas);
 544     while (k.hasNext())
 545         delete k.next();
 546     Iterator<ITrust*> l(m_trusts);
 547     while (l.hasNext())
 548         delete l.next();
 549     Iterator<IRevocation*> m(m_revocations);
 550     while (m.hasNext())
 551         delete m.next();
 552 }
 553
 554 short XMLApplication::acceptNode(const DOMNode* node) const
 555 {
 556     if (saml::XML::isElementNamed(static_cast<const DOMElement*>(node),saml::XML::SAML_NS,L(AttributeDesignator)))
 557         return FILTER_REJECT;
 558     else if (saml::XML::isElementNamed(static_cast<const DOMElement*>(node),saml::XML::SAML_NS,L(Audience)))
 559         return FILTER_REJECT;
 560     if (XMLString::compareString(node->getNamespaceURI(),ShibTargetConfig::SHIBTARGET_NS))
 561         return FILTER_ACCEPT;
 562     const XMLCh* name=node->getLocalName();
 563     if (!XMLString::compareString(name,SHIBT_L(Application)) ||
 564         !XMLString::compareString(name,SHIBT_L(AAPProvider)) ||
 565         !XMLString::compareString(name,SHIBT_L(CredentialUse)) ||
 566         !XMLString::compareString(name,SHIBT_L(RelyingParty)) ||
 567         !XMLString::compareString(name,SHIBT_L(FederationProvider)) ||
 568         !XMLString::compareString(name,SHIBT_L(RevocationProvider)) ||
 569         !XMLString::compareString(name,SHIBT_L(TrustProvider)))
 570         return FILTER_REJECT;
 571
 572     return FILTER_ACCEPT;
 573 }
 574
 575 pair<bool,bool> XMLApplication::getBool(const char* name, const char* ns) const
 576 {
 577     pair<bool,bool> ret=XMLPropertySet::getBool(name,ns);
 578     if (ret.first)
 579         return ret;
 580     return m_base ? m_base->getBool(name,ns) : ret;
 581 }
 582
 583 pair<bool,const char*> XMLApplication::getString(const char* name, const char* ns) const
 584 {
 585     pair<bool,const char*> ret=XMLPropertySet::getString(name,ns);
 586     if (ret.first)
 587         return ret;
 588     return m_base ? m_base->getString(name,ns) : ret;
 589 }
 590
 591 pair<bool,const XMLCh*> XMLApplication::getXMLString(const char* name, const char* ns) const
 592 {
 593     pair<bool,const XMLCh*> ret=XMLPropertySet::getXMLString(name,ns);
 594     if (ret.first)
 595         return ret;
 596     return m_base ? m_base->getXMLString(name,ns) : ret;
 597 }
 598
 599 pair<bool,unsigned int> XMLApplication::getUnsignedInt(const char* name, const char* ns) const
 600 {
 601     pair<bool,unsigned int> ret=XMLPropertySet::getUnsignedInt(name,ns);
 602     if (ret.first)
 603         return ret;
 604     return m_base ? m_base->getUnsignedInt(name,ns) : ret;
 605 }
 606
 607 pair<bool,int> XMLApplication::getInt(const char* name, const char* ns) const
 608 {
 609     pair<bool,int> ret=XMLPropertySet::getInt(name,ns);
 610     if (ret.first)
 611         return ret;
 612     return m_base ? m_base->getInt(name,ns) : ret;
 613 }
 614
 615 const IPropertySet* XMLApplication::getPropertySet(const char* name, const char* ns) const
 616 {
 617     const IPropertySet* ret=XMLPropertySet::getPropertySet(name,ns);
 618     if (ret || !m_base)
 619         return ret;
 620     return m_base->getPropertySet(name,ns);
 621 }
 622
 623 Iterator<SAMLAttributeDesignator*> XMLApplication::getAttributeDesignators() const
 624 {
 625     if (!m_designators.empty() || !m_base)
 626         return m_designators;
 627     return m_base->getAttributeDesignators();
 628 }
 629
 630 Iterator<IAAP*> XMLApplication::getAAPProviders() const
 631 {
 632     return (m_aaps.empty() && m_base) ? m_base->getAAPProviders() : m_aaps;
 633 }
 634
 635 Iterator<IMetadata*> XMLApplication::getMetadataProviders() const
 636 {
 637     return (m_metadatas.empty() && m_base) ? m_base->getMetadataProviders() : m_metadatas;
 638 }
 639
 640 Iterator<ITrust*> XMLApplication::getTrustProviders() const
 641 {
 642     return (m_trusts.empty() && m_base) ? m_base->getTrustProviders() : m_trusts;
 643 }
 644
 645 Iterator<IRevocation*> XMLApplication::getRevocationProviders() const
 646 {
 647     return (m_revocations.empty() && m_base) ? m_base->getRevocationProviders() : m_revocations;
 648 }
 649
 650 Iterator<const XMLCh*> XMLApplication::getAudiences() const
 651 {
 652     return (m_audiences.empty() && m_base) ? m_base->getAudiences() : m_audiences;
 653 }
 654
 655 const IPropertySet* XMLApplication::getCredentialUse(const IEntityDescriptor* provider) const
 656 {
 657     if (!m_credDefault && m_base)
 658         return m_base->getCredentialUse(provider);
 659
 660 #ifdef HAVE_GOOD_STL
 661     map<xstring,XMLPropertySet*>::const_iterator i=m_credMap.find(provider->getId());
 662     if (i!=m_credMap.end())
 663         return i->second;
 664     const IEntitiesDescriptor* group=provider->getEntitiesDescriptor();
 665     while (group) {
 666         i=m_credMap.find(group->getName());
 667         if (i!=m_credMap.end())
 668             return i->second;
 669         group=group->getEntitiesDescriptor();
 670     }
 671 #else
 672     map<const XMLCh*,XMLPropertySet*>::const_iterator i=m_credMap.begin();
 673     for (; i!=m_credMap.end(); i++) {
 674         if (!XMLString::compareString(i->first,provider->getId()))
 675             return i->second;
 676         const IEntitiesDescriptor* group=provider->getEntitiesDescriptor();
 677         while (group) {
 678             if (!XMLString::compareString(i->first,group->getName()))
 679                 return i->second;
 680             group=group->getEntitiesDescriptor();
 681         }
 682     }
 683 #endif
 684     return m_credDefault;
 685 }
 686
 687 ReloadableXMLFileImpl* XMLConfig::newImplementation(const char* pathname, bool first) const
 688 {
 689     return new XMLConfigImpl(pathname,first,this);
 690 }
 691
 692 ReloadableXMLFileImpl* XMLConfig::newImplementation(const DOMElement* e, bool first) const
 693 {
 694     return new XMLConfigImpl(e,first,this);
 695 }
 696
 697 short XMLConfigImpl::acceptNode(const DOMNode* node) const
 698 {
 699     if (XMLString::compareString(node->getNamespaceURI(),ShibTargetConfig::SHIBTARGET_NS))
 700         return FILTER_ACCEPT;
 701     const XMLCh* name=node->getLocalName();
 702     if (!XMLString::compareString(name,SHIBT_L(Applications)) ||
 703         !XMLString::compareString(name,SHIBT_L(CredentialsProvider)) ||
 704         !XMLString::compareString(name,SHIBT_L(Extensions)) ||
 705         !XMLString::compareString(name,SHIBT_L(Implementation)) ||
 706         !XMLString::compareString(name,SHIBT_L(Listener)) ||
 707         !XMLString::compareString(name,SHIBT_L(MemorySessionCache)) ||
 708         !XMLString::compareString(name,SHIBT_L(MySQLReplayCache)) ||
 709         !XMLString::compareString(name,SHIBT_L(MySQLSessionCache)) ||
 710         !XMLString::compareString(name,SHIBT_L(RequestMap)) ||
 711         !XMLString::compareString(name,SHIBT_L(RequestMapProvider)) ||
 712         !XMLString::compareString(name,SHIBT_L(ReplayCache)) ||
 713         !XMLString::compareString(name,SHIBT_L(SessionCache)) ||
 714         !XMLString::compareString(name,SHIBT_L(TCPListener)) ||
 715         !XMLString::compareString(name,SHIBT_L(UnixListener)))
 716         return FILTER_REJECT;
 717
 718     return FILTER_ACCEPT;
 719 }
 720
 721 void XMLConfigImpl::init(bool first)
 722 {
 723 #ifdef _DEBUG
 724     saml::NDC ndc("XMLConfigImpl");
 725 #endif
 726     Category& log=Category::getInstance("shibtarget.XMLConfig");
 727
 728     try {
 729         if (!saml::XML::isElementNamed(ReloadableXMLFileImpl::m_root,ShibTargetConfig::SHIBTARGET_NS,SHIBT_L(ShibbolethTargetConfig)) &&
 730             !saml::XML::isElementNamed(ReloadableXMLFileImpl::m_root,ShibTargetConfig::SHIBTARGET_NS,SHIBT_L(SPConfig))) {
 731             log.error("Construction requires a valid configuration file: (conf:SPConfig as root element)");
 732             throw MalformedException("Construction requires a valid configuration file: (conf:SPConfig as root element)");
 733         }
 734
 735         SAMLConfig& shibConf=SAMLConfig::getConfig();
 736         ShibTargetConfig& conf=ShibTargetConfig::getConfig();
 737         const DOMElement* SHAR=saml::XML::getFirstChildElement(ReloadableXMLFileImpl::m_root,ShibTargetConfig::SHIBTARGET_NS,SHIBT_L(SHAR));
 738         if (!SHAR)
 739             SHAR=saml::XML::getFirstChildElement(ReloadableXMLFileImpl::m_root,ShibTargetConfig::SHIBTARGET_NS,SHIBT_L(Global));
 740         const DOMElement* SHIRE=saml::XML::getFirstChildElement(ReloadableXMLFileImpl::m_root,ShibTargetConfig::SHIBTARGET_NS,SHIBT_L(SHIRE));
 741         if (!SHIRE)
 742             SHIRE=saml::XML::getFirstChildElement(ReloadableXMLFileImpl::m_root,ShibTargetConfig::SHIBTARGET_NS,SHIBT_L(Local));
 743
 744         // Initialize log4cpp manually in order to redirect log messages as soon as possible.
 745         if (conf.isEnabled(ShibTargetConfig::Logging)) {
 746             const XMLCh* logger=NULL;
 747             if (conf.isEnabled(ShibTargetConfig::GlobalExtensions))
 748                 logger=SHAR->getAttributeNS(NULL,SHIBT_L(logger));
 749             else if (conf.isEnabled(ShibTargetConfig::LocalExtensions))
 750                 logger=SHIRE->getAttributeNS(NULL,SHIBT_L(logger));
 751             if (!logger || !*logger)
 752                 logger=ReloadableXMLFileImpl::m_root->getAttributeNS(NULL,SHIBT_L(logger));
 753             if (logger && *logger) {
 754                 auto_ptr_char logpath(logger);
 755                 cerr << "loading new logging configuration from " << logpath.get() << "\n";
 756                 try {
 757                     PropertyConfigurator::configure(logpath.get());
 758                     cerr << "New logging configuration loaded, check log destination for process status..." << "\n";
 759                 }
 760                 catch (ConfigureFailure& e) {
 761                     cerr << "Error reading logging configuration: " << e.what() << "\n";
 762                 }
 763             }
 764         }
 765
 766         // First load any property sets.
 767         map<string,string> root_remap;
 768         root_remap["SHAR"]="Global";
 769         root_remap["SHIRE"]="Local";
 770         load(ReloadableXMLFileImpl::m_root,log,this,&root_remap);
 771
 772         // Much of the processing can only occur on the first instantiation.
 773         if (first) {
 774             // Now load any extensions to insure any needed plugins are registered.
 775             DOMElement* exts=
 776                 saml::XML::getFirstChildElement(ReloadableXMLFileImpl::m_root,ShibTargetConfig::SHIBTARGET_NS,SHIBT_L(Extensions));
 777             if (exts) {
 778                 exts=saml::XML::getFirstChildElement(exts,ShibTargetConfig::SHIBTARGET_NS,SHIBT_L(Library));
 779                 while (exts) {
 780                     auto_ptr_char path(exts->getAttributeNS(NULL,SHIBT_L(path)));
 781                     try {
 782                         SAMLConfig::getConfig().saml_register_extension(path.get(),exts);
 783                         log.debug("loaded global extension library %s",path.get());
 784                     }
 785                     catch (SAMLException& e) {
 786                         const XMLCh* fatal=exts->getAttributeNS(NULL,SHIBT_L(fatal));
 787                         if (fatal && (*fatal==chLatin_t || *fatal==chDigit_1)) {
 788                             log.fatal("unable to load mandatory global extension library %s: %s", path.get(), e.what());
 789                             throw;
 790                         }
 791                         else
 792                             log.crit("unable to load optional global extension library %s: %s", path.get(), e.what());
 793                     }
 794                     exts=saml::XML::getNextSiblingElement(exts,ShibTargetConfig::SHIBTARGET_NS,SHIBT_L(Library));
 795                 }
 796             }
 797
 798             if (conf.isEnabled(ShibTargetConfig::GlobalExtensions)) {
 799                 exts=saml::XML::getFirstChildElement(SHAR,ShibTargetConfig::SHIBTARGET_NS,SHIBT_L(Extensions));
 800                 if (exts) {
 801                     exts=saml::XML::getFirstChildElement(exts,ShibTargetConfig::SHIBTARGET_NS,SHIBT_L(Library));
 802                     while (exts) {
 803                         auto_ptr_char path(exts->getAttributeNS(NULL,SHIBT_L(path)));
 804                         try {
 805                             SAMLConfig::getConfig().saml_register_extension(path.get(),exts);
 806                             log.debug("loaded Global extension library %s",path.get());
 807                         }
 808                         catch (SAMLException& e) {
 809                             const XMLCh* fatal=exts->getAttributeNS(NULL,SHIBT_L(fatal));
 810                             if (fatal && (*fatal==chLatin_t || *fatal==chDigit_1)) {
 811                                 log.fatal("unable to load mandatory Global extension library %s: %s", path.get(), e.what());
 812                                 throw;
 813                             }
 814                             else
 815                                 log.crit("unable to load optional Global extension library %s: %s", path.get(), e.what());
 816                         }
 817                         exts=saml::XML::getNextSiblingElement(exts,ShibTargetConfig::SHIBTARGET_NS,SHIBT_L(Library));
 818                     }
 819                 }
 820             }
 821
 822             if (conf.isEnabled(ShibTargetConfig::LocalExtensions)) {
 823                 exts=saml::XML::getFirstChildElement(SHIRE,ShibTargetConfig::SHIBTARGET_NS,SHIBT_L(Extensions));
 824                 if (exts) {
 825                     exts=saml::XML::getFirstChildElement(exts,ShibTargetConfig::SHIBTARGET_NS,SHIBT_L(Library));
 826                     while (exts) {
 827                         auto_ptr_char path(exts->getAttributeNS(NULL,SHIBT_L(path)));
 828                         try {
 829                             SAMLConfig::getConfig().saml_register_extension(path.get(),exts);
 830                             log.debug("loaded Local extension library %s",path.get());
 831                         }
 832                         catch (SAMLException& e) {
 833                             const XMLCh* fatal=exts->getAttributeNS(NULL,SHIBT_L(fatal));
 834                             if (fatal && (*fatal==chLatin_t || *fatal==chDigit_1)) {
 835                                 log.fatal("unable to load mandatory Local extension library %s: %s", path.get(), e.what());
 836                                 throw;
 837                             }
 838                             else
 839                                 log.crit("unable to load optional Local extension library %s: %s", path.get(), e.what());
 840                         }
 841                         exts=saml::XML::getNextSiblingElement(exts,ShibTargetConfig::SHIBTARGET_NS,SHIBT_L(Library));
 842                     }
 843                 }
 844             }
 845
 846             // Instantiate the Listener and SessionCache objects.
 847             if (conf.isEnabled(ShibTargetConfig::Listener)) {
 848                 IPlugIn* plugin=NULL;
 849                 exts=saml::XML::getFirstChildElement(SHAR,ShibTargetConfig::SHIBTARGET_NS,SHIBT_L(UnixListener));
 850                 if (exts) {
 851                     log.info("building Listener of type %s...",shibtarget::XML::UnixListenerType);
 852                     plugin=shibConf.getPlugMgr().newPlugin(shibtarget::XML::UnixListenerType,exts);
 853                 }
 854                 else {
 855                     exts=saml::XML::getFirstChildElement(SHAR,ShibTargetConfig::SHIBTARGET_NS,SHIBT_L(TCPListener));
 856                     if (exts) {
 857                         log.info("building Listener of type %s...",shibtarget::XML::TCPListenerType);
 858                         plugin=shibConf.getPlugMgr().newPlugin(shibtarget::XML::TCPListenerType,exts);
 859                     }
 860                     else {
 861                         exts=saml::XML::getFirstChildElement(SHAR,ShibTargetConfig::SHIBTARGET_NS,SHIBT_L(Listener));
 862                         if (exts) {
 863                             auto_ptr_char type(exts->getAttributeNS(NULL,SHIBT_L(type)));
 864                             log.info("building Listener of type %s...",type.get());
 865                             plugin=shibConf.getPlugMgr().newPlugin(type.get(),exts);
 866                         }
 867                         else {
 868                             log.fatal("can't build Listener object, missing conf:Listener element?");
 869                             throw MalformedException("can't build Listener object, missing conf:Listener element?");
 870                         }
 871                     }
 872                 }
 873                 if (plugin) {
 874                     IListener* listen=dynamic_cast<IListener*>(plugin);
 875                     if (listen)
 876                         m_outer->m_listener=listen;
 877                     else {
 878                         delete plugin;
 879                         log.fatal("plugin was not a Listener object");
 880                         throw UnsupportedExtensionException("plugin was not a Listener object");
 881                     }
 882                 }
 883             }
 884
 885             if (conf.isEnabled(ShibTargetConfig::Caching)) {
 886                 IPlugIn* plugin=NULL;
 887                 exts=saml::XML::getFirstChildElement(SHAR,ShibTargetConfig::SHIBTARGET_NS,SHIBT_L(MemorySessionCache));
 888                 if (exts) {
 889                     log.info("building Session Cache of type %s...",shibtarget::XML::MemorySessionCacheType);
 890                     plugin=shibConf.getPlugMgr().newPlugin(shibtarget::XML::MemorySessionCacheType,exts);
 891                 }
 892                 else {
 893                     exts=saml::XML::getFirstChildElement(SHAR,ShibTargetConfig::SHIBTARGET_NS,SHIBT_L(MySQLSessionCache));
 894                     if (exts) {
 895                         log.info("building Session Cache of type %s...",shibtarget::XML::MySQLSessionCacheType);
 896                         plugin=shibConf.getPlugMgr().newPlugin(shibtarget::XML::MySQLSessionCacheType,exts);
 897                     }
 898                     else {
 899                         exts=saml::XML::getFirstChildElement(SHAR,ShibTargetConfig::SHIBTARGET_NS,SHIBT_L(SessionCache));
 900                         if (exts) {
 901                             auto_ptr_char type(exts->getAttributeNS(NULL,SHIBT_L(type)));
 902                             log.info("building Session Cache of type %s...",type.get());
 903                             plugin=shibConf.getPlugMgr().newPlugin(type.get(),exts);
 904                         }
 905                         else {
 906                             log.fatal("can't build Session Cache object, missing conf:SessionCache element?");
 907                             throw MalformedException("can't build Session Cache object, missing conf:SessionCache element?");
 908                         }
 909                     }
 910                 }
 911                 if (plugin) {
 912                     ISessionCache* cache=dynamic_cast<ISessionCache*>(plugin);
 913                     if (cache)
 914                         m_outer->m_sessionCache=cache;
 915                     else {
 916                         delete plugin;
 917                         log.fatal("plugin was not a Session Cache object");
 918                         throw UnsupportedExtensionException("plugin was not a Session Cache object");
 919                     }
 920                 }
 921
 922                 // Replay cache.
 923                 exts=saml::XML::getFirstChildElement(SHAR,ShibTargetConfig::SHIBTARGET_NS,SHIBT_L(MySQLReplayCache));
 924                 if (exts) {
 925                     log.info("building Replay Cache of type %s...",shibtarget::XML::MySQLReplayCacheType);
 926                     m_outer->m_replayCache=IReplayCache::getInstance(shibtarget::XML::MySQLSessionCacheType,exts);
 927                 }
 928                 else {
 929                     exts=saml::XML::getFirstChildElement(SHAR,ShibTargetConfig::SHIBTARGET_NS,SHIBT_L(ReplayCache));
 930                     if (exts) {
 931                         auto_ptr_char type(exts->getAttributeNS(NULL,SHIBT_L(type)));
 932                         log.info("building Replay Cache of type %s...",type.get());
 933                         m_outer->m_replayCache=IReplayCache::getInstance(type.get(),exts);
 934                     }
 935                     else {
 936                         // OpenSAML default provider.
 937                         log.info("building default Replay Cache...");
 938                         m_outer->m_replayCache=IReplayCache::getInstance();
 939                     }
 940                 }
 941             }
 942         }
 943
 944         // Back to the fully dynamic stuff...next up is the Request Mapper.
 945         if (conf.isEnabled(ShibTargetConfig::RequestMapper)) {
 946             const DOMElement* child=saml::XML::getFirstChildElement(SHIRE,ShibTargetConfig::SHIBTARGET_NS,SHIBT_L(RequestMapProvider));
 947             if (child) {
 948                 auto_ptr_char type(child->getAttributeNS(NULL,SHIBT_L(type)));
 949                 log.info("building Request Mapper of type %s...",type.get());
 950                 IPlugIn* plugin=shibConf.getPlugMgr().newPlugin(type.get(),child);
 951                 if (plugin) {
 952                     IRequestMapper* reqmap=dynamic_cast<IRequestMapper*>(plugin);
 953                     if (reqmap)
 954                         m_requestMapper=reqmap;
 955                     else {
 956                         delete plugin;
 957                         log.fatal("plugin was not a Request Mapper object");
 958                         throw UnsupportedExtensionException("plugin was not a Request Mapper object");
 959                     }
 960                 }
 961             }
 962             else {
 963                 log.fatal("can't build Request Mapper object, missing conf:RequestMapProvider element?");
 964                 throw MalformedException("can't build Request Mapper object, missing conf:RequestMapProvider element?");
 965             }
 966         }
 967
 968         // Now we load any credentials providers.
 969         DOMNodeList* nlist;
 970         if (conf.isEnabled(ShibTargetConfig::Credentials)) {
 971             nlist=ReloadableXMLFileImpl::m_root->getElementsByTagNameNS(
 972                 ShibTargetConfig::SHIBTARGET_NS,SHIBT_L(CredentialsProvider)
 973                 );
 974             for (int i=0; nlist && i<nlist->getLength(); i++) {
 975                 auto_ptr_char type(static_cast<DOMElement*>(nlist->item(i))->getAttributeNS(NULL,SHIBT_L(type)));
 976                 log.info("building Credentials provider of type %s...",type.get());
 977                 IPlugIn* plugin=shibConf.getPlugMgr().newPlugin(type.get(),static_cast<DOMElement*>(nlist->item(i)));
 978                 if (plugin) {
 979                     ICredentials* creds=dynamic_cast<ICredentials*>(plugin);
 980                     if (creds)
 981                         m_creds.push_back(creds);
 982                     else {
 983                         delete plugin;
 984                         log.fatal("plugin was not a Credentials provider");
 985                         throw UnsupportedExtensionException("plugin was not a Credentials provider");
 986                     }
 987                 }
 988             }
 989         }
 990
 991         // Load the default application. This actually has a fixed ID of "default". ;-)
 992         const DOMElement* app=saml::XML::getFirstChildElement(
 993             ReloadableXMLFileImpl::m_root,ShibTargetConfig::SHIBTARGET_NS,SHIBT_L(Applications)
 994             );
 995         if (!app) {
 996             log.fatal("can't build default Application object, missing conf:Applications element?");
 997             throw SAMLException("can't build default Application object, missing conf:Applications element?");
 998         }
 999         XMLApplication* defapp=new XMLApplication(m_outer, m_creds, app);
1000         m_appmap[defapp->getId()]=defapp;
1001
1002         // Load any overrides.
1003         nlist=app->getElementsByTagNameNS(ShibTargetConfig::SHIBTARGET_NS,SHIBT_L(Application));
1004         for (int i=0; nlist && i<nlist->getLength(); i++) {
1005             XMLApplication* iapp=new XMLApplication(m_outer,m_creds,static_cast<DOMElement*>(nlist->item(i)),defapp);
1006             if (m_appmap.find(iapp->getId())!=m_appmap.end()) {
1007                 log.fatal("found conf:Application element with duplicate Id attribute");
1008                 throw SAMLException("found conf:Application element with duplicate Id attribute");
1009             }
1010             m_appmap[iapp->getId()]=iapp;
1011         }
1012     }
1013     catch (SAMLException& e) {
1014         log.errorStream() << "Error while loading SP configuration: " << e.what() << CategoryStream::ENDLINE;
1015         throw;
1016     }
1017 #ifndef _DEBUG
1018     catch (...) {
1019         log.error("Unexpected error while loading SP configuration");
1020         throw;
1021     }
1022 #endif
1023 }
1024
1025 XMLConfigImpl::~XMLConfigImpl()
1026 {
1027     delete m_requestMapper;
1028     for (map<string,IApplication*>::iterator i=m_appmap.begin(); i!=m_appmap.end(); i++)
1029         delete i->second;
1030     for (vector<ICredentials*>::iterator j=m_creds.begin(); j!=m_creds.end(); j++)
1031         delete (*j);
1032 }