/*
- * Copyright 2001-2005 Internet2
- *
+ * Copyright 2001-2009 Internet2
+ *
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
# define ADFS_EXPORTS
#endif
+#include <memory>
+
#include <shibsp/base.h>
#include <shibsp/exceptions.h>
#include <shibsp/Application.h>
#ifndef SHIBSP_LITE
# include <shibsp/attribute/resolver/ResolutionContext.h>
+# include <shibsp/metadata/MetadataProviderCriteria.h>
# include <saml/SAMLConfig.h>
# include <saml/saml1/core/Assertions.h>
# include <saml/saml1/profile/AssertionValidator.h>
# include <saml/saml2/core/Assertions.h>
# include <saml/saml2/metadata/Metadata.h>
# include <saml/saml2/metadata/EndpointManager.h>
+# include <saml/saml2/profile/AssertionValidator.h>
# include <xmltooling/impl/AnyElement.h>
# include <xmltooling/validation/ValidatorSuite.h>
using namespace opensaml::saml2md;
+# ifndef min
+# define min(a,b) (((a) < (b)) ? (a) : (b))
+# endif
#endif
using namespace shibsp;
using namespace opensaml;
public:
ADFSDecoder() : m_ns(WSTRUST_NS) {}
virtual ~ADFSDecoder() {}
-
+
XMLObject* decode(string& relayState, const GenericRequest& genericRequest, SecurityPolicy& policy) const;
protected:
}
}
virtual ~ADFSSessionInitiator() {}
-
+
void setParent(const PropertySet* parent) {
DOMPropertySet::setParent(parent);
pair<bool,const char*> loc = getString("Location");
}
void receive(DDF& in, ostream& out);
- pair<bool,long> run(SPRequest& request, const char* entityID=NULL, bool isHandler=true) const;
+ pair<bool,long> unwrap(SPRequest& request, DDF& out) const;
+ pair<bool,long> run(SPRequest& request, string& entityID, bool isHandler=true) const;
private:
pair<bool,long> doRequest(
const Application& application,
+ const HTTPRequest* httpRequest,
HTTPResponse& httpResponse,
const char* entityID,
const char* acsLocation,
+ const char* authnContextClassRef,
string& relayState
) const;
string m_appId;
auto_ptr_XMLCh m_protocol;
private:
- string implementProtocol(
+ void implementProtocol(
const Application& application,
const HTTPRequest& httpRequest,
+ HTTPResponse& httpResponse,
SecurityPolicy& policy,
const PropertySet* settings,
const XMLObject& xmlObject
#endif
};
- class SHIBSP_DLLLOCAL ADFSLogoutInitiator : public AbstractHandler, public RemotedHandler
+ class SHIBSP_DLLLOCAL ADFSLogoutInitiator : public AbstractHandler, public LogoutHandler
{
public:
ADFSLogoutInitiator(const DOMElement* e, const char* appId)
}
}
virtual ~ADFSLogoutInitiator() {}
-
+
void setParent(const PropertySet* parent) {
DOMPropertySet::setParent(parent);
pair<bool,const char*> loc = getString("Location");
#endif
private:
- pair<bool,long> doRequest(
- const Application& application, const char* requestURL, const char* entityID, HTTPResponse& httpResponse
- ) const;
+ pair<bool,long> doRequest(const Application& application, const HTTPRequest& httpRequest, HTTPResponse& httpResponse, Session* session) const;
string m_appId;
auto_ptr_XMLCh m_binding;
public:
ADFSLogout(const DOMElement* e, const char* appId)
: AbstractHandler(e, Category::getInstance(SHIBSP_LOGCAT".Logout.ADFS")), m_login(e, appId) {
-#ifndef SHIBSP_LITE
m_initiator = false;
+#ifndef SHIBSP_LITE
m_preserve.push_back("wreply");
string address = string(appId) + getString("Location").second + "::run::ADFSLO";
setAddress(address.c_str());
conf.AssertionConsumerServiceManager.registerFactory(WSFED_NS, ADFSLogoutFactory);
#ifndef SHIBSP_LITE
SAMLConfig::getConfig().MessageDecoderManager.registerFactory(WSFED_NS, ADFSDecoderFactory);
- XMLObjectBuilder::registerBuilder(QName(WSTRUST_NS,"RequestedSecurityToken"), new AnyElementBuilder());
- XMLObjectBuilder::registerBuilder(QName(WSTRUST_NS,"RequestSecurityTokenResponse"), new AnyElementBuilder());
+ XMLObjectBuilder::registerBuilder(xmltooling::QName(WSTRUST_NS,"RequestedSecurityToken"), new AnyElementBuilder());
+ XMLObjectBuilder::registerBuilder(xmltooling::QName(WSTRUST_NS,"RequestSecurityTokenResponse"), new AnyElementBuilder());
#endif
return 0;
}
*/
}
-pair<bool,long> ADFSSessionInitiator::run(SPRequest& request, const char* entityID, bool isHandler) const
+pair<bool,long> ADFSSessionInitiator::run(SPRequest& request, string& entityID, bool isHandler) const
{
// We have to know the IdP to function.
- if (!entityID || !*entityID)
+ if (entityID.empty())
return make_pair(false,0L);
string target;
const Handler* ACS=NULL;
const char* option;
+ pair<bool,const char*> acClass;
const Application& app=request.getApplication();
if (isHandler) {
+ option=request.getParameter("acsIndex");
+ if (option) {
+ ACS = app.getAssertionConsumerServiceByIndex(atoi(option));
+ if (!ACS)
+ request.log(SPRequest::SPWarn, "invalid acsIndex specified in request, using default ACS location");
+ }
+
option = request.getParameter("target");
if (option)
target = option;
// Since we're passing the ACS by value, we need to compute the return URL,
// so we'll need the target resource for real.
- recoverRelayState(request.getApplication(), request, target, false);
+ recoverRelayState(request.getApplication(), request, request, target, false);
+
+ if (acClass.second = request.getParameter("authnContextClassRef"))
+ acClass.first = true;
+ else
+ acClass = getString("authnContextClassRef");
}
else {
// We're running as a "virtual handler" from within the filter.
// The target resource is the current one and everything else is defaulted.
target=request.getRequestURL();
+
+ const PropertySet* settings = request.getRequestSettings().first;
+ acClass = settings->getString("authnContextClassRef");
+ if (!acClass.first)
+ acClass = getString("authnContextClassRef");
}
// Since we're not passing by index, we need to fully compute the return URL.
- // Get all the ADFS endpoints.
- const vector<const Handler*>& handlers = app.getAssertionConsumerServicesByBinding(m_binding.get());
-
- // Index comes from request, or default set in the handler, or we just pick the first endpoint.
- pair<bool,unsigned int> index(false,0);
- if (isHandler) {
- option = request.getParameter("acsIndex");
- if (option)
- index = pair<bool,unsigned int>(true, atoi(option));
- }
- if (!index.first)
- index = getUnsignedInt("defaultACSIndex");
- if (index.first) {
- for (vector<const Handler*>::const_iterator h = handlers.begin(); !ACS && h!=handlers.end(); ++h) {
- if (index.second == (*h)->getUnsignedInt("index").second)
- ACS = *h;
+ if (!ACS) {
+ pair<bool,unsigned int> index = getUnsignedInt("defaultACSIndex");
+ if (index.first) {
+ ACS = app.getAssertionConsumerServiceByIndex(index.second);
+ if (!ACS)
+ request.log(SPRequest::SPWarn, "invalid defaultACSIndex, using default ACS location");
}
+ if (!ACS)
+ ACS = app.getDefaultAssertionConsumerService();
}
- else if (!handlers.empty()) {
- ACS = handlers.front();
+
+ // Validate the ACS for use with this protocol.
+ pair<bool,const XMLCh*> ACSbinding = ACS ? ACS->getXMLString("Binding") : pair<bool,const XMLCh*>(false,NULL);
+ if (ACSbinding.first) {
+ if (!XMLString::equals(ACSbinding.second, m_binding.get())) {
+ m_log.info("configured or requested ACS has non-ADFS binding");
+ return make_pair(false,0L);
+ }
}
- if (!ACS)
- throw ConfigurationException("Unable to locate ADFS response endpoint.");
// Compute the ACS URL. We add the ACS location to the base handlerURL.
string ACSloc=request.getHandlerURL(target.c_str());
target = option;
}
- m_log.debug("attempting to initiate session using ADFS with provider (%s)", entityID);
+ m_log.debug("attempting to initiate session using ADFS with provider (%s)", entityID.c_str());
- if (SPConfig::getConfig().isEnabled(SPConfig::OutOfProcess))
- return doRequest(app, request, entityID, ACSloc.c_str(), target);
+ if (SPConfig::getConfig().isEnabled(SPConfig::OutOfProcess)) {
+ // Out of process means the POST data via the request can be exposed directly to the private method.
+ // The method will handle POST preservation if necessary *before* issuing the response, but only if
+ // it dispatches to an IdP.
+ return doRequest(app, &request, request, entityID.c_str(), ACSloc.c_str(), (acClass.first ? acClass.second : NULL), target);
+ }
// Remote the call.
DDF out,in = DDF(m_address.c_str()).structure();
DDFJanitor jin(in), jout(out);
in.addmember("application_id").string(app.getId());
- in.addmember("entity_id").string(entityID);
+ in.addmember("entity_id").string(entityID.c_str());
in.addmember("acsLocation").string(ACSloc.c_str());
if (!target.empty())
- in.addmember("RelayState").string(target.c_str());
+ in.addmember("RelayState").unsafe_string(target.c_str());
+ if (acClass.first)
+ in.addmember("authnContextClassRef").string(acClass.second);
// Remote the processing.
out = request.getServiceProvider().getListenerService()->send(in);
return unwrap(request, out);
}
+pair<bool,long> ADFSSessionInitiator::unwrap(SPRequest& request, DDF& out) const
+{
+ // See if there's any response to send back.
+ if (!out["redirect"].isnull() || !out["response"].isnull()) {
+ // If so, we're responsible for handling the POST data, probably by dropping a cookie.
+ preservePostData(request.getApplication(), request, request, out["RelayState"].string());
+ }
+ return RemotedHandler::unwrap(request, out);
+}
+
void ADFSSessionInitiator::receive(DDF& in, ostream& out)
{
// Find application.
// Since we're remoted, the result should either be a throw, which we pass on,
// a false/0 return, which we just return as an empty structure, or a response/redirect,
// which we capture in the facade and send back.
- doRequest(*app, *http.get(), entityID, acsLocation, relayState);
+ doRequest(*app, NULL, *http.get(), entityID, acsLocation, in["authnContextClassRef"].string(), relayState);
+ if (!ret.isstruct())
+ ret.structure();
+ ret.addmember("RelayState").unsafe_string(relayState.c_str());
out << ret;
}
pair<bool,long> ADFSSessionInitiator::doRequest(
const Application& app,
+ const HTTPRequest* httpRequest,
HTTPResponse& httpResponse,
const char* entityID,
const char* acsLocation,
+ const char* authnContextClassRef,
string& relayState
) const
{
// Use metadata to invoke the SSO service directly.
MetadataProvider* m=app.getMetadataProvider();
Locker locker(m);
- MetadataProvider::Criteria mc(entityID, &IDPSSODescriptor::ELEMENT_QNAME, m_binding.get());
+ MetadataProviderCriteria mc(app, entityID, &IDPSSODescriptor::ELEMENT_QNAME, m_binding.get());
pair<const EntityDescriptor*,const RoleDescriptor*> entity=m->getEntityDescriptor(mc);
if (!entity.first) {
- m_log.error("unable to locate metadata for provider (%s)", entityID);
+ m_log.warn("unable to locate metadata for provider (%s)", entityID);
throw MetadataException("Unable to locate metadata for identity provider ($entityID)", namedparams(1, "entityID", entityID));
}
else if (!entity.second) {
- m_log.error("unable to locate ADFS-aware identity provider role for provider (%s)", entityID);
- return make_pair(false,0L);
+ m_log.log(getParent() ? Priority::INFO : Priority::WARN, "unable to locate ADFS-aware identity provider role for provider (%s)", entityID);
+ if (getParent())
+ return make_pair(false,0L);
+ throw MetadataException("Unable to locate ADFS-aware identity provider role for provider ($entityID)", namedparams(1, "entityID", entityID));
}
const EndpointType* ep = EndpointManager<SingleSignOnService>(
dynamic_cast<const IDPSSODescriptor*>(entity.second)->getSingleSignOnServices()
).getByBinding(m_binding.get());
if (!ep) {
- m_log.error("unable to locate compatible SSO service for provider (%s)", entityID);
- return make_pair(false,0L);
+ m_log.warn("unable to locate compatible SSO service for provider (%s)", entityID);
+ if (getParent())
+ return make_pair(false,0L);
+ throw MetadataException("Unable to locate compatible SSO service for provider ($entityID)", namedparams(1, "entityID", entityID));
}
preserveRelayState(app, httpResponse, relayState);
string req=string(dest.get()) + (strchr(dest.get(),'?') ? '&' : '?') + "wa=wsignin1.0&wreply=" + urlenc->encode(acsLocation) +
"&wct=" + urlenc->encode(timebuf) + "&wtrealm=" + urlenc->encode(app.getString("entityID").second);
+ if (authnContextClassRef)
+ req += "&wauth=" + urlenc->encode(authnContextClassRef);
if (!relayState.empty())
req += "&wctx=" + urlenc->encode(relayState.c_str());
+ if (httpRequest) {
+ // If the request object is available, we're responsible for the POST data.
+ preservePostData(app, *httpRequest, httpResponse, relayState.c_str());
+ }
+
return make_pair(true, httpResponse.sendRedirect(req.c_str()));
#else
return make_pair(false,0L);
// Parse and bind the document into an XMLObject.
istringstream is(param);
DOMDocument* doc = (policy.getValidating() ? XMLToolingConfig::getConfig().getValidatingParser()
- : XMLToolingConfig::getConfig().getParser()).parse(is);
+ : XMLToolingConfig::getConfig().getParser()).parse(is);
XercesJanitor<DOMDocument> janitor(doc);
auto_ptr<XMLObject> xmlObject(XMLObjectBuilder::buildOneFromElement(doc->getDocumentElement(), true));
janitor.release();
- if (!XMLHelper::isNodeNamed(xmlObject->getDOM(), m_ns.get(), RequestSecurityTokenResponse))
+ if (!XMLString::equals(xmlObject->getElementQName().getLocalPart(), RequestSecurityTokenResponse)) {
+ log.error("unrecognized root element on message: %s", xmlObject->getElementQName().toString().c_str());
throw BindingException("Decoded message was not of the appropriate type.");
+ }
- if (!policy.getValidating())
- SchemaValidators.validate(xmlObject.get());
+ SchemaValidators.validate(xmlObject.get());
// Skip policy step here, there's no security in the wrapper.
// policy.evaluate(*xmlObject.get(), &genericRequest);
-
+
return xmlObject.release();
}
-string ADFSConsumer::implementProtocol(
+void ADFSConsumer::implementProtocol(
const Application& application,
const HTTPRequest& httpRequest,
+ HTTPResponse& httpResponse,
SecurityPolicy& policy,
const PropertySet* settings,
const XMLObject& xmlObject
const ElementProxy* response = dynamic_cast<const ElementProxy*>(&xmlObject);
if (!response || !response->hasChildren())
throw FatalProfileException("Incoming message was not of the proper type or contains no security token.");
- response = dynamic_cast<const ElementProxy*>(response->getUnknownXMLObjects().front());
- if (!response || !response->hasChildren())
- throw FatalProfileException("Token wrapper element did not contain a security token.");
- const saml1::Assertion* token = dynamic_cast<const saml1::Assertion*>(response->getUnknownXMLObjects().front());
- if (!token || !token->getSignature())
- throw FatalProfileException("Incoming message did not contain a signed SAML 1.1 assertion.");
+
+ const Assertion* token = NULL;
+ for (vector<XMLObject*>::const_iterator xo = response->getUnknownXMLObjects().begin(); xo != response->getUnknownXMLObjects().end(); ++xo) {
+ // Look for the RequestedSecurityToken element.
+ if (XMLString::equals((*xo)->getElementQName().getLocalPart(), RequestedSecurityToken)) {
+ response = dynamic_cast<const ElementProxy*>(*xo);
+ if (!response || !response->hasChildren())
+ throw FatalProfileException("Token wrapper element did not contain a security token.");
+ token = dynamic_cast<const Assertion*>(response->getUnknownXMLObjects().front());
+ if (!token || !token->getSignature())
+ throw FatalProfileException("Incoming message did not contain a signed SAML assertion.");
+ break;
+ }
+ }
// Extract message and issuer details from assertion.
extractMessageDetails(*token, m_protocol.get(), policy);
// Run the policy over the assertion. Handles replay, freshness, and
// signature verification, assuming the relevant rules are configured.
- policy.evaluate(*token);
-
+ policy.evaluate(*token, &httpRequest);
+
// If no security is in place now, we kick it.
if (!policy.isAuthenticated())
throw SecurityPolicyException("Unable to establish security of incoming assertion.");
- // Now do profile and core semantic validation to ensure we can use it for SSO.
- // Profile validator.
time_t now = time(NULL);
- saml1::AssertionValidator ssoValidator(application.getAudiences(), now);
- ssoValidator.validateAssertion(*token);
- if (!token->getConditions() || !token->getConditions()->getNotBefore() || !token->getConditions()->getNotOnOrAfter())
- throw FatalProfileException("Assertion did not contain time conditions.");
- else if (token->getAuthenticationStatements().empty())
- throw FatalProfileException("Assertion did not contain an authentication statement.");
-
-
- // With ADFS, we only have one token, but we need to put it in a vector.
- vector<const Assertion*> tokens(1,token);
- const saml1::AuthenticationStatement* ssoStatement=token->getAuthenticationStatements().front();
- // authnskew allows rejection of SSO if AuthnInstant is too old.
const PropertySet* sessionProps = application.getPropertySet("Sessions");
- pair<bool,unsigned int> authnskew = sessionProps ? sessionProps->getUnsignedInt("authnskew") : pair<bool,unsigned int>(false,0);
+ const EntityDescriptor* entity = policy.getIssuerMetadata() ? dynamic_cast<const EntityDescriptor*>(policy.getIssuerMetadata()->getParent()) : NULL;
+
+ saml1::NameIdentifier* saml1name=NULL;
+ saml2::NameID* saml2name=NULL;
+ const XMLCh* authMethod=NULL;
+ const XMLCh* authInstant=NULL;
+ time_t sessionExp = 0;
+
+ const saml1::Assertion* saml1token = dynamic_cast<const saml1::Assertion*>(token);
+ if (saml1token) {
+ // Now do profile and core semantic validation to ensure we can use it for SSO.
+ saml1::AssertionValidator ssoValidator(application.getRelyingParty(entity)->getXMLString("entityID").second, application.getAudiences(), now);
+ ssoValidator.validateAssertion(*saml1token);
+ if (!saml1token->getConditions() || !saml1token->getConditions()->getNotBefore() || !saml1token->getConditions()->getNotOnOrAfter())
+ throw FatalProfileException("Assertion did not contain time conditions.");
+ else if (saml1token->getAuthenticationStatements().empty())
+ throw FatalProfileException("Assertion did not contain an authentication statement.");
+
+ // authnskew allows rejection of SSO if AuthnInstant is too old.
+ pair<bool,unsigned int> authnskew = sessionProps ? sessionProps->getUnsignedInt("maxTimeSinceAuthn") : pair<bool,unsigned int>(false,0);
+
+ const saml1::AuthenticationStatement* ssoStatement=saml1token->getAuthenticationStatements().front();
+ if (authnskew.first && authnskew.second &&
+ ssoStatement->getAuthenticationInstant() && (now - ssoStatement->getAuthenticationInstantEpoch() > authnskew.second))
+ throw FatalProfileException("The gap between now and the time you logged into your identity provider exceeds the limit.");
+
+ // Address checking.
+ saml1::SubjectLocality* locality = ssoStatement->getSubjectLocality();
+ if (locality && locality->getIPAddress()) {
+ auto_ptr_char ip(locality->getIPAddress());
+ checkAddress(application, httpRequest, ip.get());
+ }
- if (authnskew.first && authnskew.second &&
- ssoStatement->getAuthenticationInstant() && (now - ssoStatement->getAuthenticationInstantEpoch() > authnskew.second))
- throw FatalProfileException("The gap between now and the time you logged into your identity provider exceeds the limit.");
+ saml1name = ssoStatement->getSubject()->getNameIdentifier();
+ authMethod = ssoStatement->getAuthenticationMethod();
+ if (ssoStatement->getAuthenticationInstant())
+ authInstant = ssoStatement->getAuthenticationInstant()->getRawData();
- // Address checking.
- saml1::SubjectLocality* locality = ssoStatement->getSubjectLocality();
- if (locality && locality->getIPAddress()) {
- auto_ptr_char ip(locality->getIPAddress());
- checkAddress(application, httpRequest, ip.get());
+ // Session expiration.
+ pair<bool,unsigned int> lifetime = sessionProps ? sessionProps->getUnsignedInt("lifetime") : pair<bool,unsigned int>(true,28800);
+ if (!lifetime.first || lifetime.second == 0)
+ lifetime.second = 28800;
+ sessionExp = now + lifetime.second;
}
+ else {
+ const saml2::Assertion* saml2token = dynamic_cast<const saml2::Assertion*>(token);
+ if (!saml2token)
+ throw FatalProfileException("Incoming message did not contain a recognized type of SAML assertion.");
+
+ // Now do profile and core semantic validation to ensure we can use it for SSO.
+ saml2::AssertionValidator ssoValidator(application.getRelyingParty(entity)->getXMLString("entityID").second, application.getAudiences(), now);
+ ssoValidator.validateAssertion(*saml2token);
+ if (!saml2token->getConditions() || !saml2token->getConditions()->getNotBefore() || !saml2token->getConditions()->getNotOnOrAfter())
+ throw FatalProfileException("Assertion did not contain time conditions.");
+ else if (saml2token->getAuthnStatements().empty())
+ throw FatalProfileException("Assertion did not contain an authentication statement.");
+
+ // authnskew allows rejection of SSO if AuthnInstant is too old.
+ pair<bool,unsigned int> authnskew = sessionProps ? sessionProps->getUnsignedInt("maxTimeSinceAuthn") : pair<bool,unsigned int>(false,0);
+
+ const saml2::AuthnStatement* ssoStatement=saml2token->getAuthnStatements().front();
+ if (authnskew.first && authnskew.second &&
+ ssoStatement->getAuthnInstant() && (now - ssoStatement->getAuthnInstantEpoch() > authnskew.second))
+ throw FatalProfileException("The gap between now and the time you logged into your identity provider exceeds the limit.");
+
+ // Address checking.
+ saml2::SubjectLocality* locality = ssoStatement->getSubjectLocality();
+ if (locality && locality->getAddress()) {
+ auto_ptr_char ip(locality->getAddress());
+ checkAddress(application, httpRequest, ip.get());
+ }
- m_log.debug("ADFS profile processing completed successfully");
-
- saml1::NameIdentifier* n = ssoStatement->getSubject()->getNameIdentifier();
-
- // Now we have to extract the authentication details for attribute and session setup.
+ saml2name = saml2token->getSubject() ? saml2token->getSubject()->getNameID() : NULL;
+ if (ssoStatement->getAuthnContext() && ssoStatement->getAuthnContext()->getAuthnContextClassRef())
+ authMethod = ssoStatement->getAuthnContext()->getAuthnContextClassRef()->getReference();
+ if (ssoStatement->getAuthnInstant())
+ authInstant = ssoStatement->getAuthnInstant()->getRawData();
+
+ // Session expiration for SAML 2.0 is jointly IdP- and SP-driven.
+ sessionExp = ssoStatement->getSessionNotOnOrAfter() ? ssoStatement->getSessionNotOnOrAfterEpoch() : 0;
+ pair<bool,unsigned int> lifetime = sessionProps ? sessionProps->getUnsignedInt("lifetime") : pair<bool,unsigned int>(true,28800);
+ if (!lifetime.first || lifetime.second == 0)
+ lifetime.second = 28800;
+ if (sessionExp == 0)
+ sessionExp = now + lifetime.second; // IdP says nothing, calulate based on SP.
+ else
+ sessionExp = min(sessionExp, now + lifetime.second); // Use the lowest.
+ }
- // Session expiration for ADFS is purely SP-driven, and the method is mapped to a ctx class.
- pair<bool,unsigned int> lifetime = sessionProps ? sessionProps->getUnsignedInt("lifetime") : pair<bool,unsigned int>(true,28800);
- if (!lifetime.first || lifetime.second == 0)
- lifetime.second = 28800;
+ m_log.debug("ADFS profile processing completed successfully");
// We've successfully "accepted" the SSO token.
// To complete processing, we need to extract and resolve attributes and then create the session.
- // Normalize the SAML 1.x NameIdentifier...
- auto_ptr<saml2::NameID> nameid(n ? saml2::NameIDBuilder::buildNameID() : NULL);
- if (n) {
- nameid->setName(n->getName());
- nameid->setFormat(n->getFormat());
- nameid->setNameQualifier(n->getNameQualifier());
+ // Normalize a SAML 1.x NameIdentifier...
+ auto_ptr<saml2::NameID> nameid(saml1name ? saml2::NameIDBuilder::buildNameID() : NULL);
+ if (saml1name) {
+ nameid->setName(saml1name->getName());
+ nameid->setFormat(saml1name->getFormat());
+ nameid->setNameQualifier(saml1name->getNameQualifier());
}
// The context will handle deleting attributes and new tokens.
- auto_ptr<ResolutionContext> ctx(
+ vector<const Assertion*> tokens(1,token);
+ auto_ptr<ResolutionContext> ctx(
resolveAttributes(
application,
policy.getIssuerMetadata(),
m_protocol.get(),
- n,
- nameid.get(),
- ssoStatement->getAuthenticationMethod(),
+ saml1name,
+ (saml1name ? nameid.get() : saml2name),
+ authMethod,
NULL,
&tokens
)
tokens.insert(tokens.end(), ctx->getResolvedAssertions().begin(), ctx->getResolvedAssertions().end());
}
- return application.getServiceProvider().getSessionCache()->insert(
- now + lifetime.second,
+ application.getServiceProvider().getSessionCache()->insert(
application,
- httpRequest.getRemoteAddr().c_str(),
- policy.getIssuerMetadata() ? dynamic_cast<const EntityDescriptor*>(policy.getIssuerMetadata()->getParent()) : NULL,
+ httpRequest,
+ httpResponse,
+ sessionExp,
+ entity,
m_protocol.get(),
- nameid.get(),
- ssoStatement->getAuthenticationInstant() ? ssoStatement->getAuthenticationInstant()->getRawData() : NULL,
+ (saml1name ? nameid.get() : saml2name),
+ authInstant,
NULL,
- ssoStatement->getAuthenticationMethod(),
+ authMethod,
NULL,
&tokens,
ctx.get() ? &ctx->getResolvedAttributes() : NULL
if (SPConfig::getConfig().isEnabled(SPConfig::OutOfProcess)) {
// When out of process, we run natively.
- return doRequest(request.getApplication(), request.getRequestURL(), entityID.c_str(), request);
+ return doRequest(request.getApplication(), request, request, session);
}
else {
// When not out of process, we remote the request.
- Locker locker(session, false);
- DDF out,in(m_address.c_str());
+ session->unlock();
+ vector<string> headers(1,"Cookie");
+ DDF out,in = wrap(request,&headers);
DDFJanitor jin(in), jout(out);
- in.addmember("application_id").string(request.getApplication().getId());
- in.addmember("url").string(request.getRequestURL());
- in.addmember("entity_id").string(entityID.c_str());
out=request.getServiceProvider().getListenerService()->send(in);
return unwrap(request, out);
}
void ADFSLogoutInitiator::receive(DDF& in, ostream& out)
{
#ifndef SHIBSP_LITE
+ // Defer to base class for notifications
+ if (in["notify"].integer() == 1)
+ return LogoutHandler::receive(in, out);
+
// Find application.
const char* aid=in["application_id"].string();
const Application* app=aid ? SPConfig::getConfig().getServiceProvider()->getApplication(aid) : NULL;
m_log.error("couldn't find application (%s) for logout", aid ? aid : "(missing)");
throw ConfigurationException("Unable to locate application for logout, deleted?");
}
-
+
+ // Unpack the request.
+ auto_ptr<HTTPRequest> req(getRequest(in));
+
// Set up a response shim.
DDF ret(NULL);
DDFJanitor jout(ret);
auto_ptr<HTTPResponse> resp(getResponse(ret));
-
- // Since we're remoted, the result should either be a throw, which we pass on,
- // a false/0 return, which we just return as an empty structure, or a response/redirect,
- // which we capture in the facade and send back.
- doRequest(*app, in["url"].string(), in["entity_id"].string(), *resp.get());
+ Session* session = NULL;
+ try {
+ session = app->getServiceProvider().getSessionCache()->find(*app, *req.get(), NULL, NULL);
+ }
+ catch (exception& ex) {
+ m_log.error("error accessing current session: %s", ex.what());
+ }
+
+ // With no session, we just skip the request and let it fall through to an empty struct return.
+ if (session) {
+ if (session->getEntityID()) {
+ // Since we're remoted, the result should either be a throw, which we pass on,
+ // a false/0 return, which we just return as an empty structure, or a response/redirect,
+ // which we capture in the facade and send back.
+ doRequest(*app, *req.get(), *resp.get(), session);
+ }
+ else {
+ m_log.error("no issuing entityID found in session");
+ session->unlock();
+ app->getServiceProvider().getSessionCache()->remove(*app, *req.get(), resp.get());
+ }
+ }
out << ret;
#else
throw ConfigurationException("Cannot perform logout using lite version of shibsp library.");
}
pair<bool,long> ADFSLogoutInitiator::doRequest(
- const Application& application, const char* requestURL, const char* entityID, HTTPResponse& response
+ const Application& application, const HTTPRequest& httpRequest, HTTPResponse& httpResponse, Session* session
) const
{
+ // Do back channel notification.
+ vector<string> sessions(1, session->getID());
+ if (!notifyBackChannel(application, httpRequest.getRequestURL(), sessions, false)) {
+ session->unlock();
+ application.getServiceProvider().getSessionCache()->remove(application, httpRequest, &httpResponse);
+ return sendLogoutPage(application, httpRequest, httpResponse, true, "Partial logout failure.");
+ }
+
#ifndef SHIBSP_LITE
- try {
- if (!entityID)
- throw ConfigurationException("Missing entityID parameter.");
+ pair<bool,long> ret = make_pair(false,0L);
+ try {
// With a session in hand, we can create a request message, if we can find a compatible endpoint.
MetadataProvider* m=application.getMetadataProvider();
- Locker locker(m);
- MetadataProvider::Criteria mc(entityID, &IDPSSODescriptor::ELEMENT_QNAME, m_binding.get());
+ Locker metadataLocker(m);
+ MetadataProviderCriteria mc(application, session->getEntityID(), &IDPSSODescriptor::ELEMENT_QNAME, m_binding.get());
pair<const EntityDescriptor*,const RoleDescriptor*> entity=m->getEntityDescriptor(mc);
- if (!entity.first)
- throw MetadataException("Unable to locate metadata for identity provider ($entityID)", namedparams(1, "entityID", entityID));
- else if (!entity.second)
- throw MetadataException("Unable to locate ADFS IdP role for identity provider ($entityID).", namedparams(1, "entityID", entityID));
+ if (!entity.first) {
+ throw MetadataException(
+ "Unable to locate metadata for identity provider ($entityID)", namedparams(1, "entityID", session->getEntityID())
+ );
+ }
+ else if (!entity.second) {
+ throw MetadataException(
+ "Unable to locate ADFS IdP role for identity provider ($entityID).", namedparams(1, "entityID", session->getEntityID())
+ );
+ }
const EndpointType* ep = EndpointManager<SingleLogoutService>(
dynamic_cast<const IDPSSODescriptor*>(entity.second)->getSingleLogoutServices()
).getByBinding(m_binding.get());
if (!ep) {
throw MetadataException(
- "Unable to locate ADFS single logout service for identity provider ($entityID).",
- namedparams(1, "entityID", entityID)
+ "Unable to locate ADFS single logout service for identity provider ($entityID).", namedparams(1, "entityID", session->getEntityID())
);
}
+ const URLEncoder* urlenc = XMLToolingConfig::getConfig().getURLEncoder();
+ const char* returnloc = httpRequest.getParameter("return");
auto_ptr_char dest(ep->getLocation());
-
string req=string(dest.get()) + (strchr(dest.get(),'?') ? '&' : '?') + "wa=wsignout1.0";
- return make_pair(true,response.sendRedirect(req.c_str()));
+ if (returnloc)
+ req += "&wreply=" + urlenc->encode(returnloc);
+ ret.second = httpResponse.sendRedirect(req.c_str());
+ ret.first = true;
}
catch (exception& ex) {
m_log.error("error issuing ADFS logout request: %s", ex.what());
}
- return make_pair(false,0L);
+ if (session) {
+ session->unlock();
+ session = NULL;
+ application.getServiceProvider().getSessionCache()->remove(application, httpRequest, &httpResponse);
+ }
+
+ return ret;
#else
throw ConfigurationException("Cannot perform logout using lite version of shibsp library.");
#endif
param = request.getParameter("wreply");
const Application& app = request.getApplication();
- // Get the session_id.
- pair<string,const char*> shib_cookie = app.getCookieNameProps("_shibsession_");
- const char* session_id = request.getCookie(shib_cookie.first.c_str());
-
if (!returning) {
// Pass control to the first front channel notification point, if any.
map<string,string> parammap;
}
// Best effort on back channel and to remove the user agent's session.
- if (session_id) {
+ string session_id = app.getServiceProvider().getSessionCache()->active(app, request);
+ if (!session_id.empty()) {
vector<string> sessions(1,session_id);
notifyBackChannel(app, request.getRequestURL(), sessions, false);
try {
- app.getServiceProvider().getSessionCache()->remove(session_id, app);
+ app.getServiceProvider().getSessionCache()->remove(app, request, &request);
}
catch (exception& ex) {
- m_log.error("error removing session (%s): %s", session_id, ex.what());
+ m_log.error("error removing session (%s): %s", session_id.c_str(), ex.what());
}
- request.setCookie(shib_cookie.first.c_str(), shib_cookie.second);
}
if (param)
return make_pair(true, request.sendRedirect(param));
- return sendLogoutPage(app, request, false, "Logout complete.");
+ return sendLogoutPage(app, request, request, false, "Logout complete.");
}