2 * Copyright 2001-2005 Internet2
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
8 * http://www.apache.org/licenses/LICENSE-2.0
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
18 * shib-ini.h -- config file handling, now XML-based
25 #include <shib/shib-threads.h>
26 #include <log4cpp/Category.hh>
27 #include <log4cpp/PropertyConfigurator.hh>
29 #include <sys/types.h>
34 using namespace shibboleth;
35 using namespace shibtarget;
36 using namespace log4cpp;
38 namespace shibtarget {
40 // Application configuration wrapper
41 class XMLApplication : public virtual IApplication, public XMLPropertySet, public DOMNodeFilter
44 XMLApplication(const IConfig*, const Iterator<ICredentials*>& creds, const DOMElement* e, const XMLApplication* base=NULL);
45 ~XMLApplication() { cleanup(); }
48 pair<bool,bool> getBool(const char* name, const char* ns=NULL) const;
49 pair<bool,const char*> getString(const char* name, const char* ns=NULL) const;
50 pair<bool,const XMLCh*> getXMLString(const char* name, const char* ns=NULL) const;
51 pair<bool,unsigned int> getUnsignedInt(const char* name, const char* ns=NULL) const;
52 pair<bool,int> getInt(const char* name, const char* ns=NULL) const;
53 const IPropertySet* getPropertySet(const char* name, const char* ns="urn:mace:shibboleth:target:config:1.0") const;
56 const char* getId() const {return getString("id").second;}
57 const char* getHash() const {return m_hash.c_str();}
58 Iterator<SAMLAttributeDesignator*> getAttributeDesignators() const;
59 Iterator<IAAP*> getAAPProviders() const;
60 Iterator<IMetadata*> getMetadataProviders() const;
61 Iterator<ITrust*> getTrustProviders() const;
62 Iterator<const XMLCh*> getAudiences() const;
63 const IPropertySet* getCredentialUse(const IEntityDescriptor* provider) const;
64 const SAMLBrowserProfile* getBrowserProfile() const {return m_profile;}
65 const SAMLBinding* getBinding(const XMLCh* binding) const
66 {return XMLString::compareString(SAMLBinding::SOAP,binding) ? NULL : m_binding;}
67 SAMLBrowserProfile::ArtifactMapper* getArtifactMapper() const {return new STArtifactMapper(this);}
68 const IPropertySet* getDefaultSessionInitiator() const;
69 const IPropertySet* getSessionInitiatorById(const char* id) const;
70 const IPropertySet* getDefaultAssertionConsumerService() const;
71 const IPropertySet* getAssertionConsumerServiceByIndex(unsigned short index) const;
72 const IPropertySet* getHandlerConfig(const char* path) const;
74 // Provides filter to exclude special config elements.
75 short acceptNode(const DOMNode* node) const;
79 const IConfig* m_ini; // this is ok because its locking scope includes us
80 const XMLApplication* m_base;
82 vector<SAMLAttributeDesignator*> m_designators;
84 vector<IMetadata*> m_metadatas;
85 vector<ITrust*> m_trusts;
86 vector<const XMLCh*> m_audiences;
87 ShibBrowserProfile* m_profile;
88 SAMLBinding* m_binding;
89 ShibHTTPHook* m_bindingHook;
90 map<string,XMLPropertySet*> m_handlerMap;
91 map<unsigned int,const IPropertySet*> m_acsMap;
92 const IPropertySet* m_acsDefault;
93 map<string,const IPropertySet*> m_sessionInitMap;
94 const IPropertySet* m_sessionInitDefault;
95 XMLPropertySet* m_credDefault;
97 map<xstring,XMLPropertySet*> m_credMap;
99 map<const XMLCh*,XMLPropertySet*> m_credMap;
103 // Top-level configuration implementation
105 class XMLConfigImpl : public ReloadableXMLFileImpl, public XMLPropertySet, public DOMNodeFilter
108 XMLConfigImpl(const char* pathname, bool first, const XMLConfig* outer)
109 : ReloadableXMLFileImpl(pathname), m_outer(outer), m_requestMapper(NULL) { init(first); }
110 XMLConfigImpl(const DOMElement* e, bool first, const XMLConfig* outer)
111 : ReloadableXMLFileImpl(e), m_outer(outer), m_requestMapper(NULL) { init(first); }
114 IRequestMapper* m_requestMapper;
115 map<string,IApplication*> m_appmap;
116 vector<ICredentials*> m_creds;
117 vector<IAttributeFactory*> m_attrFactories;
119 // Provides filter to exclude special config elements.
120 short acceptNode(const DOMNode* node) const;
123 void init(bool first);
124 const XMLConfig* m_outer;
127 class XMLConfig : public IConfig, public ReloadableXMLFile
130 XMLConfig(const DOMElement* e) : ReloadableXMLFile(e), m_listener(NULL), m_sessionCache(NULL), m_replayCache(NULL) {}
131 ~XMLConfig() {delete m_listener; delete m_sessionCache; delete m_replayCache;}
134 pair<bool,bool> getBool(const char* name, const char* ns=NULL) const {return static_cast<XMLConfigImpl*>(m_impl)->getBool(name,ns);}
135 pair<bool,const char*> getString(const char* name, const char* ns=NULL) const {return static_cast<XMLConfigImpl*>(m_impl)->getString(name,ns);}
136 pair<bool,const XMLCh*> getXMLString(const char* name, const char* ns=NULL) const {return static_cast<XMLConfigImpl*>(m_impl)->getXMLString(name,ns);}
137 pair<bool,unsigned int> getUnsignedInt(const char* name, const char* ns=NULL) const {return static_cast<XMLConfigImpl*>(m_impl)->getUnsignedInt(name,ns);}
138 pair<bool,int> getInt(const char* name, const char* ns=NULL) const {return static_cast<XMLConfigImpl*>(m_impl)->getInt(name,ns);}
139 const IPropertySet* getPropertySet(const char* name, const char* ns="urn:mace:shibboleth:target:config:1.0") const {return static_cast<XMLConfigImpl*>(m_impl)->getPropertySet(name,ns);}
140 const DOMElement* getElement() const {return static_cast<XMLConfigImpl*>(m_impl)->getElement();}
143 const IListener* getListener() const {return m_listener;}
144 ISessionCache* getSessionCache() const {return m_sessionCache;}
145 IReplayCache* getReplayCache() const {return m_replayCache;}
146 IRequestMapper* getRequestMapper() const {return static_cast<XMLConfigImpl*>(m_impl)->m_requestMapper;}
147 const IApplication* getApplication(const char* applicationId) const {
148 map<string,IApplication*>::const_iterator i=static_cast<XMLConfigImpl*>(m_impl)->m_appmap.find(applicationId);
149 return (i!=static_cast<XMLConfigImpl*>(m_impl)->m_appmap.end()) ? i->second : NULL;
151 Iterator<ICredentials*> getCredentialsProviders() const {return static_cast<XMLConfigImpl*>(m_impl)->m_creds;}
154 virtual ReloadableXMLFileImpl* newImplementation(const char* pathname, bool first=true) const;
155 virtual ReloadableXMLFileImpl* newImplementation(const DOMElement* e, bool first=true) const;
158 friend class XMLConfigImpl;
159 mutable IListener* m_listener;
160 mutable ISessionCache* m_sessionCache;
161 mutable IReplayCache* m_replayCache;
165 IConfig* STConfig::ShibTargetConfigFactory(const DOMElement* e)
167 auto_ptr<XMLConfig> ret(new XMLConfig(e));
168 ret->getImplementation();
169 return ret.release();
172 XMLPropertySet::~XMLPropertySet()
174 for (map<string,pair<char*,const XMLCh*> >::iterator i=m_map.begin(); i!=m_map.end(); i++)
175 XMLString::release(&(i->second.first));
176 for (map<string,IPropertySet*>::iterator j=m_nested.begin(); j!=m_nested.end(); j++)
180 void XMLPropertySet::load(
183 DOMNodeFilter* filter,
184 const std::map<std::string,std::string>* remapper
188 saml::NDC ndc("load");
192 // Process each attribute as a property.
193 DOMNamedNodeMap* attrs=m_root->getAttributes();
194 for (XMLSize_t i=0; i<attrs->getLength(); i++) {
195 DOMNode* a=attrs->item(i);
196 if (!XMLString::compareString(a->getNamespaceURI(),saml::XML::XMLNS_NS))
198 char* val=XMLString::transcode(a->getNodeValue());
200 auto_ptr_char ns(a->getNamespaceURI());
201 auto_ptr_char name(a->getLocalName());
202 const char* realname=name.get();
204 map<string,string>::const_iterator remap=remapper->find(realname);
205 if (remap!=remapper->end()) {
206 log.debug("remapping property (%s) to (%s)",realname,remap->second.c_str());
207 realname=remap->second.c_str();
211 m_map[string("{") + ns.get() + '}' + realname]=pair<char*,const XMLCh*>(val,a->getNodeValue());
212 log.debug("added property {%s}%s (%s)",ns.get(),realname,val);
215 m_map[realname]=pair<char*,const XMLCh*>(val,a->getNodeValue());
216 log.debug("added property %s (%s)",realname,val);
221 // Process non-excluded elements as nested sets.
222 DOMTreeWalker* walker=
223 static_cast<DOMDocumentTraversal*>(
224 m_root->getOwnerDocument())->createTreeWalker(const_cast<DOMElement*>(m_root),DOMNodeFilter::SHOW_ELEMENT,filter,false
226 e=static_cast<DOMElement*>(walker->firstChild());
228 auto_ptr_char ns(e->getNamespaceURI());
229 auto_ptr_char name(e->getLocalName());
230 const char* realname=name.get();
232 map<string,string>::const_iterator remap=remapper->find(realname);
233 if (remap!=remapper->end()) {
234 log.debug("remapping property set (%s) to (%s)",realname,remap->second.c_str());
235 realname=remap->second.c_str();
240 key=string("{") + ns.get() + '}' + realname;
243 if (m_nested.find(key)!=m_nested.end())
244 log.warn("load() skipping duplicate property set: %s",key.c_str());
246 XMLPropertySet* set=new XMLPropertySet();
247 set->load(e,log,filter,remapper);
249 log.debug("added nested property set: %s",key.c_str());
251 e=static_cast<DOMElement*>(walker->nextSibling());
256 pair<bool,bool> XMLPropertySet::getBool(const char* name, const char* ns) const
258 pair<bool,bool> ret=pair<bool,bool>(false,false);
259 map<string,pair<char*,const XMLCh*> >::const_iterator i;
262 i=m_map.find(string("{") + ns + '}' + name);
266 if (i!=m_map.end()) {
268 ret.second=(!strcmp(i->second.first,"true") || !strcmp(i->second.first,"1"));
273 pair<bool,const char*> XMLPropertySet::getString(const char* name, const char* ns) const
275 pair<bool,const char*> ret=pair<bool,const char*>(false,NULL);
276 map<string,pair<char*,const XMLCh*> >::const_iterator i;
279 i=m_map.find(string("{") + ns + '}' + name);
283 if (i!=m_map.end()) {
285 ret.second=i->second.first;
290 pair<bool,const XMLCh*> XMLPropertySet::getXMLString(const char* name, const char* ns) const
292 pair<bool,const XMLCh*> ret=pair<bool,const XMLCh*>(false,NULL);
293 map<string,pair<char*,const XMLCh*> >::const_iterator i;
296 i=m_map.find(string("{") + ns + '}' + name);
300 if (i!=m_map.end()) {
302 ret.second=i->second.second;
307 pair<bool,unsigned int> XMLPropertySet::getUnsignedInt(const char* name, const char* ns) const
309 pair<bool,unsigned int> ret=pair<bool,unsigned int>(false,0);
310 map<string,pair<char*,const XMLCh*> >::const_iterator i;
313 i=m_map.find(string("{") + ns + '}' + name);
317 if (i!=m_map.end()) {
319 ret.second=strtol(i->second.first,NULL,10);
324 pair<bool,int> XMLPropertySet::getInt(const char* name, const char* ns) const
326 pair<bool,int> ret=pair<bool,int>(false,0);
327 map<string,pair<char*,const XMLCh*> >::const_iterator i;
330 i=m_map.find(string("{") + ns + '}' + name);
334 if (i!=m_map.end()) {
336 ret.second=atoi(i->second.first);
341 const IPropertySet* XMLPropertySet::getPropertySet(const char* name, const char* ns) const
343 map<string,IPropertySet*>::const_iterator i;
346 i=m_nested.find(string("{") + ns + '}' + name);
348 i=m_nested.find(name);
350 return (i!=m_nested.end()) ? i->second : NULL;
353 XMLApplication::XMLApplication(
355 const Iterator<ICredentials*>& creds,
357 const XMLApplication* base
358 ) : m_ini(ini), m_base(base), m_profile(NULL), m_binding(NULL), m_bindingHook(NULL),
359 m_credDefault(NULL), m_sessionInitDefault(NULL), m_acsDefault(NULL)
362 saml::NDC ndc("XMLApplication");
364 Category& log=Category::getInstance("shibtarget.XMLApplication");
367 // First load any property sets.
368 map<string,string> root_remap;
369 root_remap["shire"]="session";
370 root_remap["shireURL"]="handlerURL";
371 root_remap["shireSSL"]="handlerSSL";
372 load(e,log,this,&root_remap);
373 const IPropertySet* propcheck=getPropertySet("Errors");
374 if (propcheck && !propcheck->getString("session").first)
375 throw ConfigurationException("<Errors> element requires 'session' (or deprecated 'shire') attribute");
376 propcheck=getPropertySet("Sessions");
377 if (propcheck && !propcheck->getString("handlerURL").first)
378 throw ConfigurationException("<Sessions> element requires 'handlerURL' (or deprecated 'shireURL') attribute");
381 m_hash+=getString("providerId").second;
382 m_hash=SAMLArtifact::toHex(SAMLArtifactType0001::generateSourceId(m_hash.c_str()));
384 ShibTargetConfig& conf=ShibTargetConfig::getConfig();
385 SAMLConfig& shibConf=SAMLConfig::getConfig();
387 if (conf.isEnabled(ShibTargetConfig::RequestMapper)) {
389 bool hardACS=false, hardSessionInit=false;
390 DOMElement* handler=saml::XML::getFirstChildElement(propcheck->getElement());
392 XMLPropertySet* hprops=new XMLPropertySet();
393 hprops->load(handler,log,this); // filter irrelevant for now, no embedded elements expected
394 m_handlerMap[hprops->getString("Location").second]=hprops;
396 // If it's an ACS or SI, handle lookup mappings and defaulting.
397 if (saml::XML::isElementNamed(handler,shibtarget::XML::SAML2META_NS,SHIBT_L(AssertionConsumerService))) {
398 m_acsMap[hprops->getUnsignedInt("index").second]=hprops;
400 pair<bool,bool> defprop=hprops->getBool("isDefault");
402 if (defprop.second) {
407 else if (!m_acsDefault)
411 else if (saml::XML::isElementNamed(handler,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(SessionInitiator))) {
412 pair<bool,const char*> si_id=hprops->getString("id");
413 if (si_id.first && si_id.second)
414 m_sessionInitMap[si_id.second]=hprops;
415 if (!hardSessionInit) {
416 pair<bool,bool> defprop=hprops->getBool("isDefault");
418 if (defprop.second) {
419 hardSessionInit=true;
420 m_sessionInitDefault=hprops;
423 else if (!m_sessionInitDefault)
424 m_sessionInitDefault=hprops;
427 handler=saml::XML::getNextSiblingElement(handler);
431 // Process general configuration elements.
433 DOMNodeList* nlist=e->getElementsByTagNameNS(saml::XML::SAML_NS,L(AttributeDesignator));
434 for (i=0; nlist && i<nlist->getLength(); i++)
435 if (nlist->item(i)->getParentNode()->isSameNode(e))
436 m_designators.push_back(new SAMLAttributeDesignator(static_cast<DOMElement*>(nlist->item(i))));
438 nlist=e->getElementsByTagNameNS(saml::XML::SAML_NS,L(Audience));
439 for (i=0; nlist && i<nlist->getLength(); i++)
440 if (nlist->item(i)->getParentNode()->isSameNode(e))
441 m_audiences.push_back(nlist->item(i)->getFirstChild()->getNodeValue());
443 // Always include our own providerId as an audience.
444 m_audiences.push_back(getXMLString("providerId").second);
446 if (conf.isEnabled(ShibTargetConfig::AAP)) {
447 nlist=e->getElementsByTagNameNS(shibtarget::XML::SHIBTARGET_NS,SHIBT_L(AAPProvider));
448 for (i=0; nlist && i<nlist->getLength(); i++) {
449 if (nlist->item(i)->getParentNode()->isSameNode(e)) {
450 auto_ptr_char type(static_cast<DOMElement*>(nlist->item(i))->getAttributeNS(NULL,SHIBT_L(type)));
451 log.info("building AAP provider of type %s...",type.get());
453 IPlugIn* plugin=shibConf.getPlugMgr().newPlugin(type.get(),static_cast<DOMElement*>(nlist->item(i)));
454 IAAP* aap=dynamic_cast<IAAP*>(plugin);
456 m_aaps.push_back(aap);
459 log.crit("plugin was not an AAP provider");
462 catch (SAMLException& ex) {
463 log.crit("error building AAP provider: %s",ex.what());
469 if (conf.isEnabled(ShibTargetConfig::Metadata)) {
470 nlist=e->getElementsByTagNameNS(shibtarget::XML::SHIBTARGET_NS,SHIBT_L(MetadataProvider));
471 for (i=0; nlist && i<nlist->getLength(); i++) {
472 if (nlist->item(i)->getParentNode()->isSameNode(e)) {
473 auto_ptr_char type(static_cast<DOMElement*>(nlist->item(i))->getAttributeNS(NULL,SHIBT_L(type)));
474 log.info("building metadata provider of type %s...",type.get());
476 IPlugIn* plugin=shibConf.getPlugMgr().newPlugin(type.get(),static_cast<DOMElement*>(nlist->item(i)));
477 IMetadata* md=dynamic_cast<IMetadata*>(plugin);
479 m_metadatas.push_back(md);
482 log.crit("plugin was not a metadata provider");
485 catch (SAMLException& ex) {
486 log.crit("error building metadata provider: %s",ex.what());
490 nlist=e->getElementsByTagNameNS(shibtarget::XML::SHIBTARGET_NS,SHIBT_L(FederationProvider));
491 for (i=0; nlist && i<nlist->getLength(); i++) {
492 if (nlist->item(i)->getParentNode()->isSameNode(e)) {
493 auto_ptr_char type(static_cast<DOMElement*>(nlist->item(i))->getAttributeNS(NULL,SHIBT_L(type)));
494 log.info("building metadata provider of type %s...",type.get());
496 IPlugIn* plugin=shibConf.getPlugMgr().newPlugin(type.get(),static_cast<DOMElement*>(nlist->item(i)));
497 IMetadata* md=dynamic_cast<IMetadata*>(plugin);
499 m_metadatas.push_back(md);
502 log.crit("plugin was not a metadata provider");
505 catch (SAMLException& ex) {
506 log.crit("error building metadata provider: %s",ex.what());
512 if (conf.isEnabled(ShibTargetConfig::Trust)) {
513 nlist=e->getElementsByTagNameNS(shibtarget::XML::SHIBTARGET_NS,SHIBT_L(TrustProvider));
514 for (i=0; nlist && i<nlist->getLength(); i++) {
515 if (nlist->item(i)->getParentNode()->isSameNode(e)) {
516 auto_ptr_char type(static_cast<DOMElement*>(nlist->item(i))->getAttributeNS(NULL,SHIBT_L(type)));
517 log.info("building trust provider of type %s...",type.get());
519 IPlugIn* plugin=shibConf.getPlugMgr().newPlugin(type.get(),static_cast<DOMElement*>(nlist->item(i)));
520 ITrust* trust=dynamic_cast<ITrust*>(plugin);
522 m_trusts.push_back(trust);
525 log.crit("plugin was not a trust provider");
528 catch (SAMLException& ex) {
529 log.crit("error building trust provider: %s",ex.what());
535 // Finally, load credential mappings.
536 const DOMElement* cu=saml::XML::getFirstChildElement(e,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(CredentialUse));
538 m_credDefault=new XMLPropertySet();
539 m_credDefault->load(cu,log,this);
540 cu=saml::XML::getFirstChildElement(cu,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(RelyingParty));
542 XMLPropertySet* rp=new XMLPropertySet();
543 rp->load(cu,log,this);
544 m_credMap[cu->getAttributeNS(NULL,SHIBT_L(Name))]=rp;
545 cu=saml::XML::getNextSiblingElement(cu,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(RelyingParty));
549 if (conf.isEnabled(ShibTargetConfig::Caching)) {
550 // Really finally, build local browser profile and binding objects.
551 m_profile=new ShibBrowserProfile(
552 getMetadataProviders(),
555 m_bindingHook=new ShibHTTPHook(
559 m_binding=SAMLBinding::getInstance(SAMLBinding::SOAP);
560 SAMLSOAPHTTPBinding* bptr=dynamic_cast<SAMLSOAPHTTPBinding*>(m_binding);
562 log.fatal("binding implementation was not SOAP over HTTP");
563 throw UnsupportedExtensionException("binding implementation was not SOAP over HTTP");
565 bptr->addHook(m_bindingHook,m_bindingHook); // the hook is its own global context
568 catch (SAMLException& e) {
569 log.errorStream() << "Error while processing applicaton element: " << e.what() << CategoryStream::ENDLINE;
575 log.error("Unexpected error while processing application element");
582 void XMLApplication::cleanup()
584 delete m_bindingHook;
587 map<string,XMLPropertySet*>::iterator h=m_handlerMap.begin();
588 while (h!=m_handlerMap.end()) {
592 delete m_credDefault;
594 map<xstring,XMLPropertySet*>::iterator c=m_credMap.begin();
596 map<const XMLCh*,XMLPropertySet*>::iterator c=m_credMap.begin();
598 while (c!=m_credMap.end()) {
602 Iterator<SAMLAttributeDesignator*> i(m_designators);
605 Iterator<IAAP*> j(m_aaps);
608 Iterator<IMetadata*> k(m_metadatas);
611 Iterator<ITrust*> l(m_trusts);
616 short XMLApplication::acceptNode(const DOMNode* node) const
618 if (saml::XML::isElementNamed(static_cast<const DOMElement*>(node),saml::XML::SAML_NS,L(AttributeDesignator)))
619 return FILTER_REJECT;
620 else if (saml::XML::isElementNamed(static_cast<const DOMElement*>(node),saml::XML::SAML_NS,L(Audience)))
621 return FILTER_REJECT;
622 const XMLCh* name=node->getLocalName();
623 if (!XMLString::compareString(name,SHIBT_L(Application)) ||
624 !XMLString::compareString(name,SHIBT_L(AssertionConsumerService)) ||
625 !XMLString::compareString(name,SHIBT_L(SingleLogoutService)) ||
626 !XMLString::compareString(name,SHIBT_L(DiagnosticService)) ||
627 !XMLString::compareString(name,SHIBT_L(SessionInitiator)) ||
628 !XMLString::compareString(name,SHIBT_L(AAPProvider)) ||
629 !XMLString::compareString(name,SHIBT_L(CredentialUse)) ||
630 !XMLString::compareString(name,SHIBT_L(RelyingParty)) ||
631 !XMLString::compareString(name,SHIBT_L(FederationProvider)) ||
632 !XMLString::compareString(name,SHIBT_L(MetadataProvider)) ||
633 !XMLString::compareString(name,SHIBT_L(TrustProvider)))
634 return FILTER_REJECT;
636 return FILTER_ACCEPT;
639 pair<bool,bool> XMLApplication::getBool(const char* name, const char* ns) const
641 pair<bool,bool> ret=XMLPropertySet::getBool(name,ns);
644 return m_base ? m_base->getBool(name,ns) : ret;
647 pair<bool,const char*> XMLApplication::getString(const char* name, const char* ns) const
649 pair<bool,const char*> ret=XMLPropertySet::getString(name,ns);
652 return m_base ? m_base->getString(name,ns) : ret;
655 pair<bool,const XMLCh*> XMLApplication::getXMLString(const char* name, const char* ns) const
657 pair<bool,const XMLCh*> ret=XMLPropertySet::getXMLString(name,ns);
660 return m_base ? m_base->getXMLString(name,ns) : ret;
663 pair<bool,unsigned int> XMLApplication::getUnsignedInt(const char* name, const char* ns) const
665 pair<bool,unsigned int> ret=XMLPropertySet::getUnsignedInt(name,ns);
668 return m_base ? m_base->getUnsignedInt(name,ns) : ret;
671 pair<bool,int> XMLApplication::getInt(const char* name, const char* ns) const
673 pair<bool,int> ret=XMLPropertySet::getInt(name,ns);
676 return m_base ? m_base->getInt(name,ns) : ret;
679 const IPropertySet* XMLApplication::getPropertySet(const char* name, const char* ns) const
681 const IPropertySet* ret=XMLPropertySet::getPropertySet(name,ns);
684 return m_base->getPropertySet(name,ns);
687 Iterator<SAMLAttributeDesignator*> XMLApplication::getAttributeDesignators() const
689 if (!m_designators.empty() || !m_base)
690 return m_designators;
691 return m_base->getAttributeDesignators();
694 Iterator<IAAP*> XMLApplication::getAAPProviders() const
696 return (m_aaps.empty() && m_base) ? m_base->getAAPProviders() : m_aaps;
699 Iterator<IMetadata*> XMLApplication::getMetadataProviders() const
701 return (m_metadatas.empty() && m_base) ? m_base->getMetadataProviders() : m_metadatas;
704 Iterator<ITrust*> XMLApplication::getTrustProviders() const
706 return (m_trusts.empty() && m_base) ? m_base->getTrustProviders() : m_trusts;
709 Iterator<const XMLCh*> XMLApplication::getAudiences() const
711 return (m_audiences.empty() && m_base) ? m_base->getAudiences() : m_audiences;
714 const IPropertySet* XMLApplication::getCredentialUse(const IEntityDescriptor* provider) const
716 if (!m_credDefault && m_base)
717 return m_base->getCredentialUse(provider);
720 map<xstring,XMLPropertySet*>::const_iterator i=m_credMap.find(provider->getId());
721 if (i!=m_credMap.end())
723 const IEntitiesDescriptor* group=provider->getEntitiesDescriptor();
725 if (group->getName()) {
726 i=m_credMap.find(group->getName());
727 if (i!=m_credMap.end())
730 group=group->getEntitiesDescriptor();
733 map<const XMLCh*,XMLPropertySet*>::const_iterator i=m_credMap.begin();
734 for (; i!=m_credMap.end(); i++) {
735 if (!XMLString::compareString(i->first,provider->getId()))
737 const IEntitiesDescriptor* group=provider->getEntitiesDescriptor();
739 if (!XMLString::compareString(i->first,group->getName()))
741 group=group->getEntitiesDescriptor();
745 return m_credDefault;
748 const IPropertySet* XMLApplication::getDefaultSessionInitiator() const
750 if (m_sessionInitDefault) return m_sessionInitDefault;
751 return m_base ? m_base->getDefaultSessionInitiator() : NULL;
754 const IPropertySet* XMLApplication::getSessionInitiatorById(const char* id) const
756 map<string,const IPropertySet*>::const_iterator i=m_sessionInitMap.find(id);
757 if (i!=m_sessionInitMap.end()) return i->second;
758 return m_base ? m_base->getSessionInitiatorById(id) : NULL;
761 const IPropertySet* XMLApplication::getDefaultAssertionConsumerService() const
763 if (m_acsDefault) return m_acsDefault;
764 return m_base ? m_base->getDefaultAssertionConsumerService() : NULL;
767 const IPropertySet* XMLApplication::getAssertionConsumerServiceByIndex(unsigned short index) const
769 map<unsigned int,const IPropertySet*>::const_iterator i=m_acsMap.find(index);
770 if (i!=m_acsMap.end()) return i->second;
771 return m_base ? m_base->getAssertionConsumerServiceByIndex(index) : NULL;
774 const IPropertySet* XMLApplication::getHandlerConfig(const char* path) const
777 map<string,XMLPropertySet*>::const_iterator i=m_handlerMap.find(wrap.substr(0,wrap.find('?')));
778 return (i!=m_handlerMap.end()) ? i->second : NULL;
781 ReloadableXMLFileImpl* XMLConfig::newImplementation(const char* pathname, bool first) const
783 return new XMLConfigImpl(pathname,first,this);
786 ReloadableXMLFileImpl* XMLConfig::newImplementation(const DOMElement* e, bool first) const
788 return new XMLConfigImpl(e,first,this);
791 short XMLConfigImpl::acceptNode(const DOMNode* node) const
793 if (XMLString::compareString(node->getNamespaceURI(),shibtarget::XML::SHIBTARGET_NS))
794 return FILTER_ACCEPT;
795 const XMLCh* name=node->getLocalName();
796 if (!XMLString::compareString(name,SHIBT_L(Applications)) ||
797 !XMLString::compareString(name,SHIBT_L(AttributeFactory)) ||
798 !XMLString::compareString(name,SHIBT_L(CredentialsProvider)) ||
799 !XMLString::compareString(name,SHIBT_L(Extensions)) ||
800 !XMLString::compareString(name,SHIBT_L(Implementation)) ||
801 !XMLString::compareString(name,SHIBT_L(Listener)) ||
802 !XMLString::compareString(name,SHIBT_L(MemorySessionCache)) ||
803 !XMLString::compareString(name,SHIBT_L(MySQLReplayCache)) ||
804 !XMLString::compareString(name,SHIBT_L(MySQLSessionCache)) ||
805 !XMLString::compareString(name,SHIBT_L(RequestMap)) ||
806 !XMLString::compareString(name,SHIBT_L(RequestMapProvider)) ||
807 !XMLString::compareString(name,SHIBT_L(ReplayCache)) ||
808 !XMLString::compareString(name,SHIBT_L(SessionCache)) ||
809 !XMLString::compareString(name,SHIBT_L(TCPListener)) ||
810 !XMLString::compareString(name,SHIBT_L(UnixListener)))
811 return FILTER_REJECT;
813 return FILTER_ACCEPT;
816 void XMLConfigImpl::init(bool first)
819 saml::NDC ndc("init");
821 Category& log=Category::getInstance("shibtarget.Config");
824 if (!saml::XML::isElementNamed(ReloadableXMLFileImpl::m_root,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(ShibbolethTargetConfig)) &&
825 !saml::XML::isElementNamed(ReloadableXMLFileImpl::m_root,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(SPConfig))) {
826 log.error("Construction requires a valid configuration file: (conf:SPConfig as root element)");
827 throw ConfigurationException("Construction requires a valid configuration file: (conf:SPConfig as root element)");
830 SAMLConfig& shibConf=SAMLConfig::getConfig();
831 ShibTargetConfig& conf=ShibTargetConfig::getConfig();
832 const DOMElement* SHAR=saml::XML::getFirstChildElement(ReloadableXMLFileImpl::m_root,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(SHAR));
834 SHAR=saml::XML::getFirstChildElement(ReloadableXMLFileImpl::m_root,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(Global));
835 const DOMElement* SHIRE=saml::XML::getFirstChildElement(ReloadableXMLFileImpl::m_root,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(SHIRE));
837 SHIRE=saml::XML::getFirstChildElement(ReloadableXMLFileImpl::m_root,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(Local));
839 // Initialize log4cpp manually in order to redirect log messages as soon as possible.
840 if (conf.isEnabled(ShibTargetConfig::Logging)) {
841 const XMLCh* logger=NULL;
842 if (conf.isEnabled(ShibTargetConfig::GlobalExtensions))
843 logger=SHAR->getAttributeNS(NULL,SHIBT_L(logger));
844 else if (conf.isEnabled(ShibTargetConfig::LocalExtensions))
845 logger=SHIRE->getAttributeNS(NULL,SHIBT_L(logger));
846 if (!logger || !*logger)
847 logger=ReloadableXMLFileImpl::m_root->getAttributeNS(NULL,SHIBT_L(logger));
848 if (logger && *logger) {
849 auto_ptr_char logpath(logger);
850 cerr << "loading new logging configuration from " << logpath.get() << "\n";
852 PropertyConfigurator::configure(logpath.get());
853 cerr << "New logging configuration loaded, check log destination for process status..." << "\n";
855 catch (ConfigureFailure& e) {
856 cerr << "Error reading logging configuration: " << e.what() << "\n";
861 // First load any property sets.
862 map<string,string> root_remap;
863 root_remap["SHAR"]="Global";
864 root_remap["SHIRE"]="Local";
865 load(ReloadableXMLFileImpl::m_root,log,this,&root_remap);
867 // Much of the processing can only occur on the first instantiation.
869 // Now load any extensions to insure any needed plugins are registered.
871 saml::XML::getFirstChildElement(ReloadableXMLFileImpl::m_root,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(Extensions));
873 exts=saml::XML::getFirstChildElement(exts,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(Library));
875 auto_ptr_char path(exts->getAttributeNS(NULL,SHIBT_L(path)));
877 SAMLConfig::getConfig().saml_register_extension(path.get(),exts);
878 log.debug("loaded global extension library %s",path.get());
880 catch (SAMLException& e) {
881 const XMLCh* fatal=exts->getAttributeNS(NULL,SHIBT_L(fatal));
882 if (fatal && (*fatal==chLatin_t || *fatal==chDigit_1)) {
883 log.fatal("unable to load mandatory global extension library %s: %s", path.get(), e.what());
887 log.crit("unable to load optional global extension library %s: %s", path.get(), e.what());
889 exts=saml::XML::getNextSiblingElement(exts,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(Library));
893 if (conf.isEnabled(ShibTargetConfig::GlobalExtensions)) {
894 exts=saml::XML::getFirstChildElement(SHAR,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(Extensions));
896 exts=saml::XML::getFirstChildElement(exts,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(Library));
898 auto_ptr_char path(exts->getAttributeNS(NULL,SHIBT_L(path)));
900 SAMLConfig::getConfig().saml_register_extension(path.get(),exts);
901 log.debug("loaded Global extension library %s",path.get());
903 catch (SAMLException& e) {
904 const XMLCh* fatal=exts->getAttributeNS(NULL,SHIBT_L(fatal));
905 if (fatal && (*fatal==chLatin_t || *fatal==chDigit_1)) {
906 log.fatal("unable to load mandatory Global extension library %s: %s", path.get(), e.what());
910 log.crit("unable to load optional Global extension library %s: %s", path.get(), e.what());
912 exts=saml::XML::getNextSiblingElement(exts,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(Library));
917 if (conf.isEnabled(ShibTargetConfig::LocalExtensions)) {
918 exts=saml::XML::getFirstChildElement(SHIRE,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(Extensions));
920 exts=saml::XML::getFirstChildElement(exts,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(Library));
922 auto_ptr_char path(exts->getAttributeNS(NULL,SHIBT_L(path)));
924 SAMLConfig::getConfig().saml_register_extension(path.get(),exts);
925 log.debug("loaded Local extension library %s",path.get());
927 catch (SAMLException& e) {
928 const XMLCh* fatal=exts->getAttributeNS(NULL,SHIBT_L(fatal));
929 if (fatal && (*fatal==chLatin_t || *fatal==chDigit_1)) {
930 log.fatal("unable to load mandatory Local extension library %s: %s", path.get(), e.what());
934 log.crit("unable to load optional Local extension library %s: %s", path.get(), e.what());
936 exts=saml::XML::getNextSiblingElement(exts,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(Library));
941 // Instantiate the Listener and SessionCache objects.
942 if (conf.isEnabled(ShibTargetConfig::Listener)) {
943 IPlugIn* plugin=NULL;
944 exts=saml::XML::getFirstChildElement(SHAR,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(UnixListener));
946 log.info("building Listener of type %s...",shibtarget::XML::UnixListenerType);
947 plugin=shibConf.getPlugMgr().newPlugin(shibtarget::XML::UnixListenerType,exts);
950 exts=saml::XML::getFirstChildElement(SHAR,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(TCPListener));
952 log.info("building Listener of type %s...",shibtarget::XML::TCPListenerType);
953 plugin=shibConf.getPlugMgr().newPlugin(shibtarget::XML::TCPListenerType,exts);
956 exts=saml::XML::getFirstChildElement(SHAR,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(Listener));
958 auto_ptr_char type(exts->getAttributeNS(NULL,SHIBT_L(type)));
959 log.info("building Listener of type %s...",type.get());
960 plugin=shibConf.getPlugMgr().newPlugin(type.get(),exts);
963 log.fatal("can't build Listener object, missing conf:Listener element?");
964 throw ConfigurationException("can't build Listener object, missing conf:Listener element?");
969 IListener* listen=dynamic_cast<IListener*>(plugin);
971 m_outer->m_listener=listen;
974 log.fatal("plugin was not a Listener object");
975 throw UnsupportedExtensionException("plugin was not a Listener object");
980 if (conf.isEnabled(ShibTargetConfig::Caching)) {
981 IPlugIn* plugin=NULL;
982 exts=saml::XML::getFirstChildElement(SHAR,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(MemorySessionCache));
984 log.info("building Session Cache of type %s...",shibtarget::XML::MemorySessionCacheType);
985 plugin=shibConf.getPlugMgr().newPlugin(shibtarget::XML::MemorySessionCacheType,exts);
988 exts=saml::XML::getFirstChildElement(SHAR,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(MySQLSessionCache));
990 log.info("building Session Cache of type %s...",shibtarget::XML::MySQLSessionCacheType);
991 plugin=shibConf.getPlugMgr().newPlugin(shibtarget::XML::MySQLSessionCacheType,exts);
994 exts=saml::XML::getFirstChildElement(SHAR,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(SessionCache));
996 auto_ptr_char type(exts->getAttributeNS(NULL,SHIBT_L(type)));
997 log.info("building Session Cache of type %s...",type.get());
998 plugin=shibConf.getPlugMgr().newPlugin(type.get(),exts);
1001 log.fatal("can't build Session Cache object, missing conf:SessionCache element?");
1002 throw ConfigurationException("can't build Session Cache object, missing conf:SessionCache element?");
1007 ISessionCache* cache=dynamic_cast<ISessionCache*>(plugin);
1009 m_outer->m_sessionCache=cache;
1012 log.fatal("plugin was not a Session Cache object");
1013 throw UnsupportedExtensionException("plugin was not a Session Cache object");
1018 exts=saml::XML::getFirstChildElement(SHAR,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(MySQLReplayCache));
1020 log.info("building Replay Cache of type %s...",shibtarget::XML::MySQLReplayCacheType);
1021 m_outer->m_replayCache=IReplayCache::getInstance(shibtarget::XML::MySQLReplayCacheType,exts);
1024 exts=saml::XML::getFirstChildElement(SHAR,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(ReplayCache));
1026 auto_ptr_char type(exts->getAttributeNS(NULL,SHIBT_L(type)));
1027 log.info("building Replay Cache of type %s...",type.get());
1028 m_outer->m_replayCache=IReplayCache::getInstance(type.get(),exts);
1031 // OpenSAML default provider.
1032 log.info("building default Replay Cache...");
1033 m_outer->m_replayCache=IReplayCache::getInstance();
1039 // Back to the fully dynamic stuff...next up is the Request Mapper.
1040 if (conf.isEnabled(ShibTargetConfig::RequestMapper)) {
1041 const DOMElement* child=saml::XML::getFirstChildElement(SHIRE,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(RequestMapProvider));
1043 auto_ptr_char type(child->getAttributeNS(NULL,SHIBT_L(type)));
1044 log.info("building Request Mapper of type %s...",type.get());
1045 IPlugIn* plugin=shibConf.getPlugMgr().newPlugin(type.get(),child);
1047 IRequestMapper* reqmap=dynamic_cast<IRequestMapper*>(plugin);
1049 m_requestMapper=reqmap;
1052 log.fatal("plugin was not a Request Mapper object");
1053 throw UnsupportedExtensionException("plugin was not a Request Mapper object");
1058 log.fatal("can't build Request Mapper object, missing conf:RequestMapProvider element?");
1059 throw ConfigurationException("can't build Request Mapper object, missing conf:RequestMapProvider element?");
1063 // Now we load any credentials providers.
1065 if (conf.isEnabled(ShibTargetConfig::Credentials)) {
1066 nlist=ReloadableXMLFileImpl::m_root->getElementsByTagNameNS(shibtarget::XML::SHIBTARGET_NS,SHIBT_L(CredentialsProvider));
1067 for (int i=0; nlist && i<nlist->getLength(); i++) {
1068 auto_ptr_char type(static_cast<DOMElement*>(nlist->item(i))->getAttributeNS(NULL,SHIBT_L(type)));
1069 log.info("building credentials provider of type %s...",type.get());
1071 IPlugIn* plugin=shibConf.getPlugMgr().newPlugin(type.get(),static_cast<DOMElement*>(nlist->item(i)));
1073 ICredentials* creds=dynamic_cast<ICredentials*>(plugin);
1075 m_creds.push_back(creds);
1078 log.crit("plugin was not a credentials provider");
1082 catch (SAMLException& ex) {
1083 log.crit("error building credentials provider: %s",ex.what());
1088 // Now we load any attribute factories
1089 nlist=ReloadableXMLFileImpl::m_root->getElementsByTagNameNS(shibtarget::XML::SHIBTARGET_NS,SHIBT_L(AttributeFactory));
1090 for (int i=0; nlist && i<nlist->getLength(); i++) {
1091 auto_ptr_char type(static_cast<DOMElement*>(nlist->item(i))->getAttributeNS(NULL,SHIBT_L(type)));
1092 log.info("building Attribute factory of type %s...",type.get());
1094 IPlugIn* plugin=shibConf.getPlugMgr().newPlugin(type.get(),static_cast<DOMElement*>(nlist->item(i)));
1096 IAttributeFactory* fact=dynamic_cast<IAttributeFactory*>(plugin);
1098 m_attrFactories.push_back(fact);
1099 ShibConfig::getConfig().regAttributeMapping(
1100 static_cast<DOMElement*>(nlist->item(i))->getAttributeNS(NULL,L(AttributeName)),
1106 log.crit("plugin was not an Attribute factory");
1110 catch (SAMLException& ex) {
1111 log.crit("error building Attribute factory: %s",ex.what());
1115 // Load the default application. This actually has a fixed ID of "default". ;-)
1116 const DOMElement* app=saml::XML::getFirstChildElement(
1117 ReloadableXMLFileImpl::m_root,shibtarget::XML::SHIBTARGET_NS,SHIBT_L(Applications)
1120 log.fatal("can't build default Application object, missing conf:Applications element?");
1121 throw ConfigurationException("can't build default Application object, missing conf:Applications element?");
1123 XMLApplication* defapp=new XMLApplication(m_outer, m_creds, app);
1124 m_appmap[defapp->getId()]=defapp;
1126 // Load any overrides.
1127 nlist=app->getElementsByTagNameNS(shibtarget::XML::SHIBTARGET_NS,SHIBT_L(Application));
1128 for (int j=0; nlist && j<nlist->getLength(); j++) {
1129 XMLApplication* iapp=new XMLApplication(m_outer,m_creds,static_cast<DOMElement*>(nlist->item(j)),defapp);
1130 if (m_appmap.find(iapp->getId())!=m_appmap.end()) {
1131 log.fatal("found conf:Application element with duplicate Id attribute");
1132 throw ConfigurationException("found conf:Application element with duplicate Id attribute");
1134 m_appmap[iapp->getId()]=iapp;
1137 catch (SAMLException& e) {
1138 log.errorStream() << "Error while loading SP configuration: " << e.what() << CategoryStream::ENDLINE;
1143 log.error("Unexpected error while loading SP configuration");
1149 XMLConfigImpl::~XMLConfigImpl()
1151 delete m_requestMapper;
1152 for (map<string,IApplication*>::iterator i=m_appmap.begin(); i!=m_appmap.end(); i++)
1154 for (vector<ICredentials*>::iterator j=m_creds.begin(); j!=m_creds.end(); j++)
1156 ShibConfig::getConfig().clearAttributeMappings();
1157 for (vector<IAttributeFactory*>::iterator k=m_attrFactories.begin(); k!=m_attrFactories.end(); k++)