- try
- {
- ostringstream threadid;
- threadid << "[" << getpid() << "] nsapi_shib" << '\0';
- saml::NDC ndc(threadid.str().c_str());
-
- // We lock the configuration system for the duration.
- IConfig* conf=g_Config->getINI();
- Locker locker(conf);
-
- // Map request to application and content settings.
- string targeturl;
- IRequestMapper* mapper=conf->getRequestMapper();
- Locker locker2(mapper);
- IRequestMapper::Settings settings=map_request(pb,sn,rq,mapper,targeturl);
- pair<bool,const char*> application_id=settings.first->getString("applicationId");
- const IApplication* application=conf->getApplication(application_id.second);
- if (!application)
- return WriteClientError(sn,rq,FUNC,"Unable to map request to application settings, check configuration.");
-
- // Declare SHIRE object for this request.
- SHIRE shire(application);
-
- const char* shireURL=shire.getShireURL(targeturl.c_str());
- if (!shireURL)
- return WriteClientError(sn,rq,FUNC,"Unable to map request to proper shireURL setting, check configuration.");
-
- // If the user is accessing the SHIRE acceptance point, pass it on.
- if (targeturl.find(shireURL)!=string::npos)
- return REQ_PROCEED;
-
- // Now check the policy for this request.
- pair<bool,bool> requireSession=settings.first->getBool("requireSession");
- if (!requireSession.first || !requireSession.second) {
- const char* param=pblock_findval("require-session",pb);
- if (param && (!strcmp(param,"1") || !strcasecmp(param,"true")))
- requireSession.second=true;
- }
- pair<const char*,const char*> shib_cookie=shire.getCookieNameProps();
- pair<bool,bool> httpRedirects=application->getPropertySet("Sessions")->getBool("httpRedirects");
- pair<bool,const char*> redirectPage=application->getPropertySet("Sessions")->getString("redirectPage");
- if (httpRedirects.first && !httpRedirects.second && !redirectPage.first)
- return WriteClientError(sn,rq,FUNC,"HTML-based redirection requires a redirectPage property.");
-
- // Check for session cookie.
- const char* session_id=NULL;
- string cookie;
- if (request_header("cookie",(char**)&session_id,sn,rq)==REQ_ABORTED)
- return WriteClientError(sn,rq,FUNC,"error accessing cookie header");
-
- Category::getInstance("nsapi_shib."FUNC).debug("cookie header is {%s}",session_id ? session_id : "NULL");
- if (session_id && (session_id=strstr(session_id,shib_cookie.first))) {
- session_id+=strlen(shib_cookie.first) + 1; /* Skip over the '=' */
- char* cookieend=strchr(session_id,';');
- if (cookieend) {
- // Chop out just the value portion.
- cookie.assign(session_id,cookieend-session_id-1);
- session_id=cookie.c_str();
- }
- }
-
- if (!session_id || !*session_id) {
- // If no session required, bail now.
- if (!requireSession.second)
- return REQ_PROCEED;
-
- // No acceptable cookie, and we require a session. Generate an AuthnRequest.
- const char* areq = shire.getAuthnRequest(targeturl.c_str());
- if (!httpRedirects.first || httpRedirects.second) {
- pblock_nvinsert("Content-Type","text/html",rq->srvhdrs);
- pblock_nvinsert("Content-Length","40",rq->srvhdrs);
- pblock_nvinsert("Expires","01-Jan-1997 12:00:00 GMT",rq->srvhdrs);
- pblock_nvinsert("Cache-Control","private,no-store,no-cache",rq->srvhdrs);
- pblock_nvinsert("Location",areq,rq->srvhdrs);
- protocol_status(sn,rq,PROTOCOL_REDIRECT,"302 Please wait");
- protocol_start_response(sn,rq);
- NET_WRITE("<HTML><BODY>Redirecting...</BODY></HTML>");
- return REQ_EXIT;
- }
- else {
- ShibMLP markupProcessor;
- markupProcessor.insert("requestURL",areq);
- return WriteRedirectPage(sn, rq, application, redirectPage.second, markupProcessor);
- }
- }
-
- // Make sure this session is still valid.
- RPCError* status = NULL;
- ShibMLP markupProcessor;
- markupProcessor.insert("requestURL", targeturl);
-
- try {
- status = shire.sessionIsValid(session_id, pblock_findval("ip",sn->client));
- }
- catch (ShibTargetException &e) {
- markupProcessor.insert("errorType", "Session Processing Error");
- markupProcessor.insert("errorText", e.what());
- markupProcessor.insert("errorDesc", "An error occurred while processing your request.");
- return WriteClientError(sn, rq, application, "shire", markupProcessor);
- }
-#ifndef _DEBUG
- catch (...) {
- markupProcessor.insert("errorType", "Session Processing Error");
- markupProcessor.insert("errorText", "Unexpected Exception");
- markupProcessor.insert("errorDesc", "An error occurred while processing your request.");
- return WriteClientError(sn, rq, application, "shire", markupProcessor);
- }
-#endif
-
- // Check the status
- if (status->isError()) {
- if (!requireSession.second)
- return REQ_PROCEED;
- else if (status->isRetryable()) {
- // Oops, session is invalid. Generate AuthnRequest.
- delete status;
- const char* areq = shire.getAuthnRequest(targeturl.c_str());
- if (!httpRedirects.first || httpRedirects.second) {
- pblock_nvinsert("Content-Type","text/html",rq->srvhdrs);
- pblock_nvinsert("Content-Length","40",rq->srvhdrs);
- pblock_nvinsert("Expires","01-Jan-1997 12:00:00 GMT",rq->srvhdrs);
- pblock_nvinsert("Cache-Control","private,no-store,no-cache",rq->srvhdrs);
- pblock_nvinsert("Location",areq,rq->srvhdrs);
- protocol_status(sn,rq,PROTOCOL_REDIRECT,"302 Please wait");
- protocol_start_response(sn,rq);
- NET_WRITE("<HTML><BODY>Redirecting...</BODY></HTML>");
- return REQ_EXIT;
- }
- else {
- markupProcessor.insert("requestURL",areq);
- return WriteRedirectPage(sn, rq, application, redirectPage.second, markupProcessor);
- }
- }
- else {
- // return the error page to the user
- markupProcessor.insert(*status);
- delete status;
- return WriteClientError(sn, rq, application, "shire", markupProcessor);
- }
- }
- delete status;
-
- // Move to RM phase.
- RM rm(application);
- vector<SAMLAssertion*> assertions;
- SAMLAuthenticationStatement* sso_statement=NULL;
-
- try {
- status = rm.getAssertions(session_id, pblock_findval("ip",sn->client), assertions, &sso_statement);
- }
- catch (ShibTargetException &e) {
- markupProcessor.insert("errorType", "Attribute Processing Error");
- markupProcessor.insert("errorText", e.what());
- markupProcessor.insert("errorDesc", "An error occurred while processing your request.");
- return WriteClientError(sn, rq, application, "rm", markupProcessor);
- }
- #ifndef _DEBUG
- catch (...) {
- markupProcessor.insert("errorType", "Attribute Processing Error");
- markupProcessor.insert("errorText", "Unexpected Exception");
- markupProcessor.insert("errorDesc", "An error occurred while processing your request.");
- return WriteClientError(sn, rq, application, "rm", markupProcessor);
- }
- #endif
-
- if (status->isError()) {
- markupProcessor.insert(*status);
- delete status;
- return WriteClientError(sn, rq, application, "rm", markupProcessor);
- }
- delete status;
-
- // Do we have an access control plugin?
- if (settings.second) {
- Locker acllock(settings.second);
- if (!settings.second->authorized(*sso_statement,assertions)) {
- for (int k = 0; k < assertions.size(); k++)
- delete assertions[k];
- delete sso_statement;
- return WriteClientError(sn, rq, application, "access", markupProcessor);
- }
- }
-
- // Get the AAP providers, which contain the attribute policy info.
- Iterator<IAAP*> provs=application->getAAPProviders();
-
- // Clear out the list of mapped attributes
- while (provs.hasNext()) {
- IAAP* aap=provs.next();
- aap->lock();
- try {
- Iterator<const IAttributeRule*> rules=aap->getAttributeRules();
- while (rules.hasNext()) {
- const char* header=rules.next()->getHeader();
- if (header)
- param_free(pblock_remove(header,rq->headers));
- }
- }
- catch(...) {
- aap->unlock();
- for (int k = 0; k < assertions.size(); k++)
- delete assertions[k];
- delete sso_statement;
- markupProcessor.insert("errorType", "Attribute Processing Error");
- markupProcessor.insert("errorText", "Unexpected Exception");
- markupProcessor.insert("errorDesc", "An error occurred while processing your request.");
- return WriteClientError(sn, rq, application, "rm", markupProcessor);
- }
- aap->unlock();
- }
- provs.reset();
-
- // Maybe export the first assertion.
- param_free(pblock_remove("remote-user",rq->headers));
- param_free(pblock_remove("auth-user",rq->vars));
- param_free(pblock_remove("Shib-Attributes",rq->headers));
- pair<bool,bool> exp=settings.first->getBool("exportAssertion");
- if (!exp.first || !exp.second) {
- const char* param=pblock_findval("export-assertion",pb);
- if (param && (!strcmp(param,"1") || !strcasecmp(param,"true")))
- exp.second=true;
- }
- if (exp.second && assertions.size()) {
- string assertion;
- RM::serialize(*(assertions[0]), assertion);
- string::size_type lfeed;
- while ((lfeed=assertion.find('\n'))!=string::npos)
- assertion.erase(lfeed,1);
- pblock_nvinsert("Shib-Attributes",assertion.c_str(),rq->headers);
- }
-
- pblock_nvinsert("auth-type","shibboleth",rq->vars);
- param_free(pblock_remove("Shib-Origin-Site",rq->headers));
- param_free(pblock_remove("Shib-Authentication-Method",rq->headers));
- param_free(pblock_remove("Shib-NameIdentifier-Format",rq->headers));
-
- // Export the SAML AuthnMethod and the origin site name.
- auto_ptr_char os(sso_statement->getSubject()->getNameIdentifier()->getNameQualifier());
- auto_ptr_char am(sso_statement->getAuthMethod());
- pblock_nvinsert("Shib-Origin-Site",os.get(),rq->headers);
- pblock_nvinsert("Shib-Authentication-Method",am.get(),rq->headers);
-
- // Export NameID?
- AAP wrapper(provs,sso_statement->getSubject()->getNameIdentifier()->getFormat(),Constants::SHIB_ATTRIBUTE_NAMESPACE_URI);
- if (!wrapper.fail() && wrapper->getHeader()) {
- auto_ptr_char form(sso_statement->getSubject()->getNameIdentifier()->getFormat());
- auto_ptr_char nameid(sso_statement->getSubject()->getNameIdentifier()->getName());
- pblock_nvinsert("Shib-NameIdentifier-Format",form.get(),pb);
- if (!strcmp(wrapper->getHeader(),"REMOTE_USER")) {
- pblock_nvinsert("remote-user",nameid.get(),rq->headers);
- pblock_nvinsert("auth-user",nameid.get(),rq->vars);
- }
- else {
- pblock_nvinsert(wrapper->getHeader(),nameid.get(),rq->headers);
- }
- }
-
- param_free(pblock_remove("Shib-Application-ID",rq->headers));
- pblock_nvinsert("Shib-Application-ID",application_id.second,rq->headers);
-
- // Export the attributes.
- Iterator<SAMLAssertion*> a_iter(assertions);
- while (a_iter.hasNext()) {
- SAMLAssertion* assert=a_iter.next();
- Iterator<SAMLStatement*> statements=assert->getStatements();
- while (statements.hasNext()) {
- SAMLAttributeStatement* astate=dynamic_cast<SAMLAttributeStatement*>(statements.next());
- if (!astate)
- continue;
- Iterator<SAMLAttribute*> attrs=astate->getAttributes();
- while (attrs.hasNext()) {
- SAMLAttribute* attr=attrs.next();
-
- // Are we supposed to export it?
- AAP wrapper(provs,attr->getName(),attr->getNamespace());
- if (wrapper.fail() || !wrapper->getHeader())
- continue;
-
- Iterator<string> vals=attr->getSingleByteValues();
- if (!strcmp(wrapper->getHeader(),"REMOTE_USER") && vals.hasNext()) {
- char* principal=const_cast<char*>(vals.next().c_str());
- pblock_nvinsert("remote-user",principal,rq->headers);
- pblock_nvinsert("auth-user",principal,rq->vars);
- }
- else {
- int it=0;
- string header;
- const char* h=pblock_findval(wrapper->getHeader(),rq->headers);
- if (h) {
- header=h;
- param_free(pblock_remove(wrapper->getHeader(),rq->headers));
- it++;
- }
- for (; vals.hasNext(); it++) {
- string value = vals.next();
- for (string::size_type pos = value.find_first_of(";", string::size_type(0));
- pos != string::npos;
- pos = value.find_first_of(";", pos)) {
- value.insert(pos, "\\");
- pos += 2;
- }
- if (it == 0)
- header=value;
- else
- header=header + ';' + value;
- }
- pblock_nvinsert(wrapper->getHeader(),header.c_str(),rq->headers);
- }
- }
- }
- }
-
- // clean up memory
- for (int k = 0; k < assertions.size(); k++)
- delete assertions[k];
- delete sso_statement;
-
- return REQ_PROCEED;
- }
- catch(bad_alloc) {
- return WriteClientError(sn, rq, FUNC,"Out of Memory");
- }
-#ifndef _DEBUG
- catch(...) {
- return WriteClientError(sn, rq, FUNC,"Server caught an unknown exception.");
- }
-#endif
-
- return WriteClientError(sn, rq, FUNC,"Server reached unreachable code, save my walrus!");