2 * Licensed to the University Corporation for Advanced Internet
3 * Development, Inc. (UCAID) under one or more contributor license
4 * agreements. See the NOTICE file distributed with this work for
5 * additional information regarding copyright ownership.
7 * UCAID licenses this file to you under the Apache License,
8 * Version 2.0 (the "License"); you may not use this file except
9 * in compliance with the License. You may obtain a copy of the
12 * http://www.apache.org/licenses/LICENSE-2.0
14 * Unless required by applicable law or agreed to in writing,
15 * software distributed under the License is distributed on an
16 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
17 * either express or implied. See the License for the specific
18 * language governing permissions and limitations under the License.
22 * @file shibsp/Application.h
24 * Interface to a Shibboleth Application instance.
27 #ifndef __shibsp_app_h__
28 #define __shibsp_app_h__
30 #include <shibsp/util/PropertySet.h>
35 # include <saml/binding/MessageEncoder.h>
38 namespace xmltooling {
39 class XMLTOOL_API CredentialResolver;
40 class XMLTOOL_API GenericRequest;
41 class XMLTOOL_API RWLock;
42 class XMLTOOL_API SOAPTransport;
43 class XMLTOOL_API StorageService;
44 class XMLTOOL_API TrustEngine;
49 class SAML_API SecurityPolicyRule;
51 class SAML_API MetadataProvider;
59 class SHIBSP_API AttributeExtractor;
60 class SHIBSP_API AttributeFilter;
61 class SHIBSP_API AttributeResolver;
63 class SHIBSP_API Attribute;
64 class SHIBSP_API Handler;
65 class SHIBSP_API ServiceProvider;
66 class SHIBSP_API SessionInitiator;
67 class SHIBSP_API SPRequest;
69 #if defined (_MSC_VER)
70 #pragma warning( push )
71 #pragma warning( disable : 4251 )
75 * Interface to a Shibboleth Application instance.
77 * <p>An Application is a logical set of resources that act as a unit
78 * of session management and policy.
80 class SHIBSP_API Application : public virtual PropertySet
82 ,public virtual opensaml::MessageEncoder::ArtifactGenerator
85 MAKE_NONCOPYABLE(Application);
90 * @param sp parent ServiceProvider instance
92 Application(const ServiceProvider* sp);
94 /** Pointer to parent SP instance. */
95 const ServiceProvider* m_sp;
97 /** Shared lock for manipulating application state. */
98 mutable xmltooling::RWLock* m_lock;
100 /** Pairs of raw and normalized CGI header names to clear. */
101 mutable std::vector< std::pair<std::string,std::string> > m_unsetHeaders;
104 virtual ~Application();
107 * Returns the owning ServiceProvider instance.
109 * @return a locked ServiceProvider
111 const ServiceProvider& getServiceProvider() const;
114 * Returns the Application's ID.
118 virtual const char* getId() const;
121 * Returns a unique hash for the Application.
123 * @return a value resulting from a computation over the Application's configuration
125 virtual const char* getHash() const=0;
128 * Returns the name and cookie properties to use for this Application.
130 * @param prefix a value to prepend to the base cookie name
131 * @param lifetime if non-null, will be populated with a suggested lifetime for the cookie, or 0 if session-bound
132 * @return a pair containing the cookie name and the string to append to the cookie value
134 virtual std::pair<std::string,const char*> getCookieNameProps(const char* prefix, time_t* lifetime=nullptr) const;
138 * Returns a MetadataProvider for use with this Application.
140 * @param required true iff an exception should be thrown if no MetadataProvider is available
141 * @return a MetadataProvider instance, or nullptr
143 virtual opensaml::saml2md::MetadataProvider* getMetadataProvider(bool required=true) const=0;
146 * Returns a TrustEngine for use with this Application.
148 * @param required true iff an exception should be thrown if no TrustEngine is available
149 * @return a TrustEngine instance, or nullptr
151 virtual xmltooling::TrustEngine* getTrustEngine(bool required=true) const=0;
154 * Returns an AttributeExtractor for use with this Application.
156 * @return an AttributeExtractor, or nullptr
158 virtual AttributeExtractor* getAttributeExtractor() const=0;
161 * Returns an AttributeFilter for use with this Application.
163 * @return an AttributeFilter, or nullptr
165 virtual AttributeFilter* getAttributeFilter() const=0;
168 * Returns an AttributeResolver for use with this Application.
170 * @return an AttributeResolver, or nullptr
172 virtual AttributeResolver* getAttributeResolver() const=0;
175 * Returns the CredentialResolver instance associated with this Application.
177 * @return a CredentialResolver, or nullptr
179 virtual xmltooling::CredentialResolver* getCredentialResolver() const=0;
182 * Returns configuration properties governing security interactions with a peer.
184 * @param provider a peer entity's metadata
185 * @return the applicable PropertySet
187 virtual const PropertySet* getRelyingParty(const opensaml::saml2md::EntityDescriptor* provider) const=0;
190 * Returns configuration properties governing security interactions with a named peer.
192 * @param entityID a peer name
193 * @return the applicable PropertySet
195 virtual const PropertySet* getRelyingParty(const XMLCh* entityID) const=0;
199 * Returns any additional audience values associated with this Application.
201 * @return additional audience values associated with the Application, or nullptr
203 virtual const std::vector<const XMLCh*>* getAudiences() const=0;
207 * Returns the designated notification URL, or an empty string if no more locations are specified.
209 * @param request requested URL to use to fill in missing pieces of notification URL
210 * @param front true iff front channel notification is desired, false iff back channel is desired
211 * @param index zero-based index of URL to return
212 * @return the designated URL, or an empty string
214 virtual std::string getNotificationURL(const char* request, bool front, unsigned int index) const=0;
217 * Returns an array of attribute IDs to use as a REMOTE_USER value, in order of preference.
219 * @return an array of attribute IDs, possibly empty
221 virtual const std::vector<std::string>& getRemoteUserAttributeIds() const=0;
224 * Ensures no value exists for a request header, allowing for application-specific customization.
226 * @param request SP request to modify
227 * @param rawname raw name of header to clear
228 * @param cginame CGI-equivalent name of header, <strong>MUST</strong> begin with "HTTP_".
230 virtual void clearHeader(SPRequest& request, const char* rawname, const char* cginame) const;
233 * Sets a value for a request header allowing for application-specific customization.
235 * @param request SP request to modify
236 * @param name name of header to set
237 * @param value value to set
239 virtual void setHeader(SPRequest& request, const char* name, const char* value) const;
242 * Returns a non-spoofable request header value allowing for application-specific customization.
244 * @param request SP request to access
245 * @param name the name of the secure header to return
246 * @return the header's value, or an empty string
248 virtual std::string getSecureHeader(const SPRequest& request, const char* name) const;
251 * Clears any headers that may be used to hold attributes after export.
253 * @param request SP request to clear
255 virtual void clearAttributeHeaders(SPRequest& request) const;
258 * Returns the default SessionInitiator when automatically requesting a session.
260 * @return the default SessionInitiator, or nullptr
262 virtual const SessionInitiator* getDefaultSessionInitiator() const=0;
265 * Returns a SessionInitiator with a particular ID when automatically requesting a session.
267 * @param id an identifier unique to the Application
268 * @return the designated SessionInitiator, or nullptr
270 virtual const SessionInitiator* getSessionInitiatorById(const char* id) const=0;
273 * Returns the default AssertionConsumerService Handler
274 * for use in AuthnRequest messages.
276 * @return the default AssertionConsumerService, or nullptr
278 virtual const Handler* getDefaultAssertionConsumerService() const=0;
281 * Returns an AssertionConsumerService Handler with a particular index
282 * for use in AuthnRequest messages.
284 * @param index an index unique to an application
285 * @return the designated AssertionConsumerService, or nullptr
287 virtual const Handler* getAssertionConsumerServiceByIndex(unsigned short index) const=0;
290 * Returns an AssertionConsumerService Handler that supports
291 * a particular protocol "family" and optional binding.
293 * @param protocol a protocol identifier
294 * @param binding a binding identifier
295 * @return a matching AssertionConsumerService, or nullptr
297 virtual const Handler* getAssertionConsumerServiceByProtocol(const XMLCh* protocol, const char* binding=nullptr) const;
301 * Returns one or more AssertionConsumerService Handlers that support
302 * a particular protocol binding.
304 * @param binding a protocol binding identifier
305 * @return a set of qualifying AssertionConsumerServices
307 virtual const std::vector<const Handler*>& getAssertionConsumerServicesByBinding(const XMLCh* binding) const=0;
310 * Returns the Handler associated with a particular path/location.
312 * @param path the PATH_INFO appended to the end of a base Handler location
313 * that invokes the Handler
314 * @return the mapped Handler, or nullptr
316 virtual const Handler* getHandler(const char* path) const=0;
319 * Returns all registered Handlers.
321 * @param handlers array to populate
323 virtual void getHandlers(std::vector<const Handler*>& handlers) const=0;
326 * Checks a proposed redirect URL against application-specific settings for legal redirects,
327 * such as same-host restrictions or whitelisted domains, and raises a SecurityPolicyException
328 * in the event of a violation.
330 * @param request the request leading to the redirect
331 * @param url an absolute URL to validate
333 virtual void limitRedirect(const xmltooling::GenericRequest& request, const char* url) const;
336 #if defined (_MSC_VER)
337 #pragma warning( pop )
342 #endif /* __shibsp_app_h__ */