2 * Copyright 2001-2007 Internet2
\r
4 * Licensed under the Apache License, Version 2.0 (the "License");
\r
5 * you may not use this file except in compliance with the License.
\r
6 * You may obtain a copy of the License at
\r
8 * http://www.apache.org/licenses/LICENSE-2.0
\r
10 * Unless required by applicable law or agreed to in writing, software
\r
11 * distributed under the License is distributed on an "AS IS" BASIS,
\r
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
\r
13 * See the License for the specific language governing permissions and
\r
14 * limitations under the License.
\r
20 * SAML Attribute Query tool layered on SP configuration
\r
23 #if defined (_MSC_VER) || defined(__BORLANDC__)
\r
24 # include "config_win32.h"
\r
26 # include "config.h"
\r
30 # define _CRT_NONSTDC_NO_DEPRECATE 1
\r
31 # define _CRT_SECURE_NO_DEPRECATE 1
\r
34 #include <shibsp/Application.h>
\r
35 #include <shibsp/exceptions.h>
\r
36 #include <shibsp/SPConfig.h>
\r
37 #include <shibsp/ServiceProvider.h>
\r
38 #include <shibsp/binding/SOAPClient.h>
\r
39 #include <shibsp/util/SPConstants.h>
\r
41 #include <saml/binding/SecurityPolicy.h>
\r
42 #include <saml/saml1/binding/SAML1SOAPClient.h>
\r
43 #include <saml/saml1/core/Assertions.h>
\r
44 #include <saml/saml1/core/Protocols.h>
\r
45 #include <saml/saml2/binding/SAML2SOAPClient.h>
\r
46 #include <saml/saml2/core/Protocols.h>
\r
47 #include <saml/saml2/metadata/Metadata.h>
\r
48 #include <xercesc/util/XMLUniDefs.hpp>
\r
49 #include <xmltooling/XMLToolingConfig.h>
\r
50 #include <xmltooling/util/XMLHelper.h>
\r
52 using namespace shibsp;
\r
53 using namespace opensaml::saml1;
\r
54 using namespace opensaml::saml1p;
\r
55 using namespace opensaml::saml2;
\r
56 using namespace opensaml::saml2p;
\r
57 using namespace opensaml::saml2md;
\r
58 using namespace opensaml;
\r
59 using namespace xmltooling;
\r
60 using namespace std;
\r
66 int main(int argc,char* argv[])
\r
75 for (int i=1; i<argc; i++) {
\r
76 if (!strcmp(argv[i],"-n") && i+1<argc)
\r
78 else if (!strcmp(argv[i],"-q") && i+1<argc)
\r
80 else if (!strcmp(argv[i],"-f") && i+1<argc)
\r
82 else if (!strcmp(argv[i],"-a") && i+1<argc)
\r
86 if (!n_param || !q_param) {
\r
87 cerr << "usage: samlquery -n <name> -q <IdP> [-f <format URI> -a <application id>]" << endl;
\r
91 path=getenv("SHIBSP_SCHEMAS");
\r
93 path=SHIBSP_SCHEMAS;
\r
94 config=getenv("SHIBSP_CONFIG");
\r
96 config=SHIBSP_CONFIG;
\r
100 SPConfig& conf=SPConfig::getConfig();
\r
102 SPConfig::Metadata |
\r
104 SPConfig::Credentials |
\r
105 SPConfig::AttributeResolver |
\r
106 SPConfig::OutOfProcess
\r
108 if (!conf.init(path))
\r
112 static const XMLCh path[] = UNICODE_LITERAL_4(p,a,t,h);
\r
113 static const XMLCh validate[] = UNICODE_LITERAL_8(v,a,l,i,d,a,t,e);
\r
114 DOMDocument* dummydoc=XMLToolingConfig::getConfig().getParser().newDocument();
\r
115 XercesJanitor<DOMDocument> docjanitor(dummydoc);
\r
116 DOMElement* dummy = dummydoc->createElementNS(NULL,path);
\r
117 auto_ptr_XMLCh src(config);
\r
118 dummy->setAttributeNS(NULL,path,src.get());
\r
119 dummy->setAttributeNS(NULL,validate,xmlconstants::XML_ONE);
\r
121 conf.setServiceProvider(conf.ServiceProviderManager.newPlugin(XML_SERVICE_PROVIDER,dummy));
\r
122 conf.getServiceProvider()->init();
\r
124 catch (exception&) {
\r
129 ServiceProvider* sp=conf.getServiceProvider();
\r
133 const Application* app=sp->getApplication(a_param);
\r
135 throw ConfigurationException("Application ($1) not found in configuration.", params(1,a_param));
\r
137 auto_ptr_XMLCh domain(q_param);
\r
138 auto_ptr_XMLCh name(n_param);
\r
139 auto_ptr_XMLCh format(f_param);
\r
140 auto_ptr_XMLCh issuer(app->getString("providerId").second);
\r
142 MetadataProvider* m=app->getMetadataProvider();
\r
143 xmltooling::Locker mlocker(m);
\r
144 const EntityDescriptor* site=m->getEntityDescriptor(domain.get());
\r
146 throw MetadataException("Unable to locate metadata for IdP ($1).", params(1,q_param));
\r
148 // Try to locate an AA role.
\r
150 const AttributeAuthorityDescriptor* AA=NULL;
\r
151 if (AA=site->getAttributeAuthorityDescriptor(samlconstants::SAML20P_NS))
\r
153 else if (AA=site->getAttributeAuthorityDescriptor(samlconstants::SAML11_PROTOCOL_ENUM))
\r
155 else if (AA=site->getAttributeAuthorityDescriptor(samlconstants::SAML10_PROTOCOL_ENUM))
\r
158 throw MetadataException("No AttributeAuthority role found in metadata.");
\r
160 SecurityPolicy policy;
\r
161 shibsp::SOAPClient soaper(*app,policy);
\r
164 auto_ptr_XMLCh binding(samlconstants::SAML20_BINDING_SOAP);
\r
165 opensaml::saml2p::StatusResponseType* srt=NULL;
\r
166 const vector<AttributeService*>& endpoints=AA->getAttributeServices();
\r
167 for (vector<AttributeService*>::const_iterator ep=endpoints.begin(); !srt && ep!=endpoints.end(); ++ep) {
\r
169 if (!XMLString::equals((*ep)->getBinding(),binding.get()))
\r
171 auto_ptr_char loc((*ep)->getLocation());
\r
172 NameID* nameid = NameIDBuilder::buildNameID();
\r
173 opensaml::saml2::Subject* subject = opensaml::saml2::SubjectBuilder::buildSubject();
\r
174 subject->setNameID(nameid);
\r
175 opensaml::saml2p::AttributeQuery* query = opensaml::saml2p::AttributeQueryBuilder::buildAttributeQuery();
\r
176 query->setSubject(subject);
\r
177 Issuer* iss = IssuerBuilder::buildIssuer();
\r
178 query->setIssuer(iss);
\r
179 nameid->setName(name.get());
\r
180 nameid->setFormat(format.get() ? format.get() : NameID::TRANSIENT);
\r
181 nameid->setNameQualifier(domain.get());
\r
182 iss->setName(issuer.get());
\r
183 SAML2SOAPClient client(soaper);
\r
184 client.sendSAML(query, *AA, loc.get());
\r
185 srt = client.receiveSAML();
\r
187 catch (exception& ex) {
\r
188 cerr << "Caught exception: " << ex.what() << endl << endl;
\r
194 throw BindingException("Unable to successfully query for attributes.");
\r
195 const opensaml::saml2p::Response* response = dynamic_cast<opensaml::saml2p::Response*>(srt);
\r
197 const vector<opensaml::saml2::Assertion*>& assertions = response->getAssertions();
\r
198 if (assertions.size())
\r
199 cout << *assertions.front();
\r
201 cout << "No assertions found.";
\r
206 auto_ptr_XMLCh binding(samlconstants::SAML1_BINDING_SOAP);
\r
207 const opensaml::saml1p::Response* response=NULL;
\r
208 const vector<AttributeService*>& endpoints=AA->getAttributeServices();
\r
209 for (vector<AttributeService*>::const_iterator ep=endpoints.begin(); !response && ep!=endpoints.end(); ++ep) {
\r
211 if (!XMLString::equals((*ep)->getBinding(),binding.get()))
\r
213 auto_ptr_char loc((*ep)->getLocation());
\r
214 NameIdentifier* nameid = NameIdentifierBuilder::buildNameIdentifier();
\r
215 opensaml::saml1::Subject* subject = opensaml::saml1::SubjectBuilder::buildSubject();
\r
216 subject->setNameIdentifier(nameid);
\r
217 opensaml::saml1p::AttributeQuery* query = opensaml::saml1p::AttributeQueryBuilder::buildAttributeQuery();
\r
218 query->setSubject(subject);
\r
219 Request* request = RequestBuilder::buildRequest();
\r
220 request->setAttributeQuery(query);
\r
221 nameid->setName(name.get());
\r
222 nameid->setFormat(format.get() ? format.get() : shibspconstants::SHIB1_NAMEID_FORMAT_URI);
\r
223 nameid->setNameQualifier(domain.get());
\r
224 query->setResource(issuer.get());
\r
225 request->setMinorVersion(ver==v11 ? 1 : 0);
\r
226 SAML1SOAPClient client(soaper);
\r
227 client.sendSAML(request, *AA, loc.get());
\r
228 response = client.receiveSAML();
\r
230 catch (exception& ex) {
\r
231 cerr << "Caught exception: " << ex.what() << endl << endl;
\r
237 throw BindingException("Unable to successfully query for attributes.");
\r
239 const vector<opensaml::saml1::Assertion*>& assertions = response->getAssertions();
\r
240 if (assertions.size())
\r
241 cout << *assertions.front();
\r
243 cout << "No assertions found.";
\r
245 delete const_cast<opensaml::saml1p::Response*>(response);
\r
248 catch(exception& ex) {
\r
249 cerr << ex.what() << endl;
\r