- try {
- m = app->getMetadataProvider();
- xmltooling::Locker mlocker(m);
- MetadataProviderCriteria mc(*app, issuer,
- &IDPSSODescriptor::ELEMENT_QNAME,
- samlconstants::SAML20P_NS);
- pair<const EntityDescriptor *, const RoleDescriptor *> site =
- m->getEntityDescriptor(mc);
- if (!site.first) {
- auto_ptr_char temp(issuer);
- throw MetadataException("Unable to locate metadata for IdP ($1).",
- params(1,temp.get()));
+/*
+ * gss_eap_saml_attr_provider is for retrieving the underlying attributes.
+ */
+bool
+gss_eap_saml_attr_provider::getAssertion(int *authenticated,
+ saml2::Assertion **pAssertion,
+ bool createIfAbsent) const
+{
+ gss_eap_saml_assertion_provider *saml;
+
+ if (authenticated != NULL)
+ *authenticated = false;
+ if (pAssertion != NULL)
+ *pAssertion = NULL;
+
+ saml = static_cast<const gss_eap_saml_assertion_provider *>
+ (m_manager->getProvider(ATTR_TYPE_SAML_ASSERTION));
+ if (saml == NULL)
+ return false;
+
+ if (authenticated != NULL)
+ *authenticated = saml->authenticated();
+ if (pAssertion != NULL)
+ *pAssertion = saml->getAssertion();
+
+ if (saml->getAssertion() == NULL) {
+ if (createIfAbsent) {
+ if (authenticated != NULL)
+ *authenticated = false;
+ if (pAssertion != NULL)
+ *pAssertion = saml->initAssertion();
+ } else
+ return false;
+ }
+
+ return true;
+}
+
+bool
+gss_eap_saml_attr_provider::getAttributeTypes(gss_eap_attr_enumeration_cb addAttribute,
+ void *data) const
+{
+ saml2::Assertion *assertion;
+ int authenticated;
+
+ if (!getAssertion(&authenticated, &assertion))
+ return true;
+
+ /*
+ * Note: the first prefix is added by the attribute provider manager
+ *
+ * From draft-hartman-gss-eap-naming-00:
+ *
+ * Each attribute carried in the assertion SHOULD also be a GSS name
+ * attribute. The name of this attribute has three parts, all separated
+ * by an ASCII space character. The first part is
+ * urn:ietf:params:gss-eap:saml-attr. The second part is the URI for
+ * the SAML attribute name format. The final part is the name of the
+ * SAML attribute. If the mechanism performs an additional attribute
+ * query, the retrieved attributes SHOULD be GSS-API name attributes
+ * using the same name syntax.
+ */
+ /* For each attribute statement, look for an attribute match */
+ const vector <saml2::AttributeStatement *> &statements =
+ const_cast<const saml2::Assertion *>(assertion)->getAttributeStatements();
+
+ for (vector<saml2::AttributeStatement *>::const_iterator s = statements.begin();
+ s != statements.end();
+ ++s) {
+ const vector<saml2::Attribute*> &attrs =
+ const_cast<const saml2::AttributeStatement*>(*s)->getAttributes();
+
+ for (vector<saml2::Attribute*>::const_iterator a = attrs.begin(); a != attrs.end(); ++a) {
+ const XMLCh *attributeName, *attributeNameFormat;
+ XMLCh space[2] = { ' ', 0 };
+ gss_buffer_desc utf8;
+
+ attributeName = (*a)->getName();
+ attributeNameFormat = (*a)->getNameFormat();
+ if (attributeNameFormat == NULL || attributeNameFormat[0] == '\0')
+ attributeNameFormat = saml2::Attribute::UNSPECIFIED;
+
+ XMLCh qualifiedName[XMLString::stringLen(attributeNameFormat) + 1 +
+ XMLString::stringLen(attributeName) + 1];
+ XMLString::copyString(qualifiedName, attributeNameFormat);
+ XMLString::catString(qualifiedName, space);
+ XMLString::catString(qualifiedName, attributeName);
+
+ utf8.value = (void *)toUTF8(qualifiedName);
+ utf8.length = strlen((char *)utf8.value);
+
+ if (!addAttribute(m_manager, this, &utf8, data))
+ return false;