/*
- * Copyright 2001-2005 Internet2
+ * Copyright 2001-2007 Internet2
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* limitations under the License.
*/
-/* isapi_shib.cpp - Shibboleth ISAPI filter
-
- Scott Cantor
- 8/23/02
-*/
+/**
+ * isapi_shib.cpp
+ *
+ * Shibboleth ISAPI filter
+ */
#include "config_win32.h"
-// SAML Runtime
-#include <saml/saml.h>
-#include <shib/shib.h>
-#include <shib/shib-threads.h>
+#define _CRT_NONSTDC_NO_DEPRECATE 1
+#define _CRT_SECURE_NO_DEPRECATE 1
+
+#include <shibsp/AbstractSPRequest.h>
+#include <shibsp/SPConfig.h>
+#include <xmltooling/util/NDC.h>
+
#include <shib-target/shib-target.h>
-#include <ctime>
-#include <fstream>
#include <sstream>
-#include <stdexcept>
+#include <fstream>
#include <process.h>
#include <httpfilt.h>
#include <httpext.h>
+using namespace shibsp;
+using namespace xmltooling;
using namespace std;
-using namespace saml;
-using namespace shibboleth;
-using namespace shibtarget;
// globals
namespace {
- static const XMLCh name[] = { chLatin_n, chLatin_a, chLatin_m, chLatin_e, chNull };
- static const XMLCh port[] = { chLatin_p, chLatin_o, chLatin_r, chLatin_t, chNull };
- static const XMLCh sslport[] = { chLatin_s, chLatin_s, chLatin_l, chLatin_p, chLatin_o, chLatin_r, chLatin_t, chNull };
- static const XMLCh scheme[] = { chLatin_s, chLatin_c, chLatin_h, chLatin_e, chLatin_m, chLatin_e, chNull };
- static const XMLCh id[] = { chLatin_i, chLatin_d, chNull };
- static const XMLCh Implementation[] =
- { chLatin_I, chLatin_m, chLatin_p, chLatin_l, chLatin_e, chLatin_m, chLatin_e, chLatin_n, chLatin_t, chLatin_a, chLatin_t, chLatin_i, chLatin_o, chLatin_n, chNull };
- static const XMLCh ISAPI[] = { chLatin_I, chLatin_S, chLatin_A, chLatin_P, chLatin_I, chNull };
- static const XMLCh Alias[] = { chLatin_A, chLatin_l, chLatin_i, chLatin_a, chLatin_s, chNull };
- static const XMLCh normalizeRequest[] =
- { chLatin_n, chLatin_o, chLatin_r, chLatin_m, chLatin_a, chLatin_l, chLatin_i, chLatin_z, chLatin_e,
- chLatin_R, chLatin_e, chLatin_q, chLatin_u, chLatin_e, chLatin_s, chLatin_t, chNull
- };
- static const XMLCh Site[] = { chLatin_S, chLatin_i, chLatin_t, chLatin_e, chNull };
+ static const XMLCh name[] = UNICODE_LITERAL_4(n,a,m,e);
+ static const XMLCh port[] = UNICODE_LITERAL_4(p,o,r,t);
+ static const XMLCh sslport[] = UNICODE_LITERAL_7(s,s,l,p,o,r,t);
+ static const XMLCh scheme[] = UNICODE_LITERAL_6(s,c,h,e,m,e);
+ static const XMLCh id[] = UNICODE_LITERAL_2(i,d);
+ static const XMLCh Implementation[] = UNICODE_LITERAL_14(I,m,p,l,e,m,e,n,t,a,t,i,o,n);
+ static const XMLCh ISAPI[] = UNICODE_LITERAL_5(I,S,A,P,I);
+ static const XMLCh Alias[] = UNICODE_LITERAL_5(A,l,i,a,s);
+ static const XMLCh normalizeRequest[] = UNICODE_LITERAL_16(n,o,r,m,a,l,i,z,e,R,e,q,u,e,s,t);
+ static const XMLCh Site[] = UNICODE_LITERAL_4(S,i,t,e);
struct site_t {
site_t(const DOMElement* e)
if (s.get()) m_scheme=s.get();
if (p.get()) m_port=p.get();
if (p2.get()) m_sslport=p2.get();
- DOMNodeList* nlist=e->getElementsByTagNameNS(shibtarget::XML::SHIBTARGET_NS,Alias);
- for (unsigned int i=0; nlist && i<nlist->getLength(); i++) {
- if (nlist->item(i)->hasChildNodes()) {
- auto_ptr_char alias(nlist->item(i)->getFirstChild()->getNodeValue());
+ e = XMLHelper::getFirstChildElement(e, Alias);
+ while (e) {
+ if (e->hasChildNodes()) {
+ auto_ptr_char alias(e->getFirstChild()->getNodeValue());
m_aliases.insert(alias.get());
}
+ e = XMLHelper::getNextSiblingElement(e, Alias);
}
}
string m_scheme,m_port,m_sslport,m_name;
};
HINSTANCE g_hinstDLL;
- ShibTargetConfig* g_Config = NULL;
+ shibtarget::ShibTargetConfig* g_Config = NULL;
map<string,site_t> g_Sites;
bool g_bNormalizeRequest = true;
}
if (!pVer)
return FALSE;
- if (!g_Config)
- {
+ if (!g_Config) {
LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL,
"Extension mode startup not possible, is the DLL loaded as a filter?");
return FALSE;
LPCSTR config=getenv("SHIBCONFIG");
if (!config)
config=SHIB_CONFIG;
- g_Config=&ShibTargetConfig::getConfig();
- g_Config->setFeatures(
- ShibTargetConfig::Listener |
- ShibTargetConfig::Metadata |
- ShibTargetConfig::AAP |
- ShibTargetConfig::RequestMapper |
- ShibTargetConfig::LocalExtensions |
- ShibTargetConfig::Logging
+ g_Config=&shibtarget::ShibTargetConfig::getConfig();
+ SPConfig::getConfig().setFeatures(
+ SPConfig::Listener |
+ SPConfig::Caching |
+ SPConfig::Metadata |
+ SPConfig::AAP |
+ SPConfig::RequestMapping |
+ SPConfig::InProcess |
+ SPConfig::Logging
);
if (!g_Config->init(schemadir)) {
g_Config=NULL;
}
// Access the implementation-specifics for site mappings.
- IConfig* conf=g_Config->getINI();
- Locker locker(conf);
- const IPropertySet* props=conf->getPropertySet("Local");
+ ServiceProvider* conf=SPConfig::getConfig().getServiceProvider();
+ xmltooling::Locker locker(conf);
+ const PropertySet* props=conf->getPropertySet("Local");
if (props) {
- const DOMElement* impl=saml::XML::getFirstChildElement(
- props->getElement(),shibtarget::XML::SHIBTARGET_NS,Implementation
- );
- if (impl && (impl=saml::XML::getFirstChildElement(impl,shibtarget::XML::SHIBTARGET_NS,ISAPI))) {
+ const DOMElement* impl=XMLHelper::getFirstChildElement(props->getElement(),Implementation);
+ if (impl && (impl=XMLHelper::getFirstChildElement(impl,ISAPI))) {
const XMLCh* flag=impl->getAttributeNS(NULL,normalizeRequest);
g_bNormalizeRequest=(!flag || !*flag || *flag==chDigit_1 || *flag==chLatin_t);
- impl=saml::XML::getFirstChildElement(impl,shibtarget::XML::SHIBTARGET_NS,Site);
+ impl=XMLHelper::getFirstChildElement(impl,Site);
while (impl) {
auto_ptr_char id(impl->getAttributeNS(NULL,id));
if (id.get())
g_Sites.insert(pair<string,site_t>(id.get(),site_t(impl)));
- impl=saml::XML::getNextSiblingElement(impl,shibtarget::XML::SHIBTARGET_NS,Site);
+ impl=XMLHelper::getNextSiblingElement(impl,Site);
}
}
}
}
void GetServerVariable(PHTTP_FILTER_CONTEXT pfc, LPSTR lpszVariable, dynabuf& s, DWORD size=80, bool bRequired=true)
- throw (bad_alloc, DWORD)
{
s.reserve(size);
s.erase();
size=s.size();
- while (!pfc->GetServerVariable(pfc,lpszVariable,s,&size))
- {
+ while (!pfc->GetServerVariable(pfc,lpszVariable,s,&size)) {
// Grumble. Check the error.
DWORD e=GetLastError();
if (e==ERROR_INSUFFICIENT_BUFFER)
}
void GetServerVariable(LPEXTENSION_CONTROL_BLOCK lpECB, LPSTR lpszVariable, dynabuf& s, DWORD size=80, bool bRequired=true)
- throw (bad_alloc, DWORD)
{
s.reserve(size);
s.erase();
size=s.size();
- while (!lpECB->GetServerVariable(lpECB->ConnID,lpszVariable,s,&size))
- {
+ while (!lpECB->GetServerVariable(lpECB->ConnID,lpszVariable,s,&size)) {
// Grumble. Check the error.
DWORD e=GetLastError();
if (e==ERROR_INSUFFICIENT_BUFFER)
void GetHeader(PHTTP_FILTER_PREPROC_HEADERS pn, PHTTP_FILTER_CONTEXT pfc,
LPSTR lpszName, dynabuf& s, DWORD size=80, bool bRequired=true)
- throw (bad_alloc, DWORD)
{
s.reserve(size);
s.erase();
size=s.size();
- while (!pn->GetHeader(pfc,lpszName,s,&size))
- {
+ while (!pn->GetHeader(pfc,lpszName,s,&size)) {
// Grumble. Check the error.
DWORD e=GetLastError();
if (e==ERROR_INSUFFICIENT_BUFFER)
/****************************************************************************/
// ISAPI Filter
-class ShibTargetIsapiF : public ShibTarget
+class ShibTargetIsapiF : public AbstractSPRequest
{
PHTTP_FILTER_CONTEXT m_pfc;
PHTTP_FILTER_PREPROC_HEADERS m_pn;
- string m_cookie;
+ map<string,string> m_headers;
+ vector<XSECCryptoX509*> m_certs;
+ int m_port;
+ string m_scheme,m_hostname,m_uri;
+ mutable string m_remote_addr,m_content_type,m_method;
+
public:
ShibTargetIsapiF(PHTTP_FILTER_CONTEXT pfc, PHTTP_FILTER_PREPROC_HEADERS pn, const site_t& site) {
+ m_pfc = pfc;
+ m_pn = pn;
+
// URL path always come from IIS.
- dynabuf url(256);
- GetHeader(pn,pfc,"url",url,256,false);
+ dynabuf var(256);
+ GetHeader(pn,pfc,"url",var,256,false);
+ m_uri = var;
// Port may come from IIS or from site def.
- dynabuf port(11);
- if (!g_bNormalizeRequest || (pfc->fIsSecurePort && site.m_sslport.empty()) || (!pfc->fIsSecurePort && site.m_port.empty()))
- GetServerVariable(pfc,"SERVER_PORT",port,10);
+ if (!g_bNormalizeRequest || (pfc->fIsSecurePort && site.m_sslport.empty()) || (!pfc->fIsSecurePort && site.m_port.empty())) {
+ GetServerVariable(pfc,"SERVER_PORT",var,10);
+ m_port = atoi(var);
+ }
else if (pfc->fIsSecurePort) {
- strncpy(port,site.m_sslport.c_str(),10);
- static_cast<char*>(port)[10]=0;
+ m_port = atoi(site.m_sslport.c_str());
}
else {
- strncpy(port,site.m_port.c_str(),10);
- static_cast<char*>(port)[10]=0;
+ m_port = atoi(site.m_port.c_str());
}
// Scheme may come from site def or be derived from IIS.
- const char* scheme=site.m_scheme.c_str();
- if (!scheme || !*scheme || !g_bNormalizeRequest)
- scheme=pfc->fIsSecurePort ? "https" : "http";
+ m_scheme=site.m_scheme;
+ if (m_scheme.empty() || !g_bNormalizeRequest)
+ m_scheme=pfc->fIsSecurePort ? "https" : "http";
- // Get the rest of the server variables.
- dynabuf remote_addr(16),method(5),content_type(32),hostname(32);
- GetServerVariable(pfc,"SERVER_NAME",hostname,32);
- GetServerVariable(pfc,"REMOTE_ADDR",remote_addr,16);
- GetServerVariable(pfc,"REQUEST_METHOD",method,5,false);
- GetServerVariable(pfc,"CONTENT_TYPE",content_type,32,false);
+ GetServerVariable(pfc,"SERVER_NAME",var,32);
// Make sure SERVER_NAME is "authorized" for use on this site. If not, set to canonical name.
- const char* host=hostname;
- if (site.m_name!=host && site.m_aliases.find(host)==site.m_aliases.end())
- host=site.m_name.c_str();
-
- init(scheme, host, atoi(port), url, content_type, remote_addr, method);
-
- m_pfc = pfc;
- m_pn = pn;
+ m_hostname = var;
+ if (site.m_name!=m_hostname && site.m_aliases.find(m_hostname)==site.m_aliases.end())
+ m_hostname=site.m_name;
}
~ShibTargetIsapiF() { }
- virtual void log(ShibLogLevel level, const string &msg) {
- ShibTarget::log(level,msg);
- if (level == LogLevelError)
- LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, msg.c_str());
+ const char* getScheme() const {
+ return m_scheme.c_str();
}
- virtual string getCookies() const {
- dynabuf buf(128);
- GetHeader(m_pn, m_pfc, "Cookie:", buf, 128, false);
- return buf.empty() ? "" : buf;
+ const char* getHostname() const {
+ return m_hostname.c_str();
}
-
- virtual void clearHeader(const string &name) {
- string hdr = (name=="REMOTE_USER" ? "remote-user" : name) + ":";
+ int getPort() const {
+ return m_port;
+ }
+ const char* getRequestURI() const {
+ return m_uri.c_str();
+ }
+ const char* getMethod() const {
+ if (m_method.empty()) {
+ dynabuf var(5);
+ GetServerVariable(m_pfc,"REQUEST_METHOD",var,5,false);
+ if (!var.empty())
+ m_method = var;
+ }
+ return m_method.c_str();
+ }
+ string getContentType() const {
+ if (m_content_type.empty()) {
+ dynabuf var(32);
+ GetServerVariable(m_pfc,"CONTENT_TYPE",var,32,false);
+ if (!var.empty())
+ m_content_type = var;
+ }
+ return m_content_type;
+ }
+ long getContentLength() const {
+ return 0;
+ }
+ string getRemoteAddr() const {
+ if (m_remote_addr.empty()) {
+ dynabuf var(16);
+ GetServerVariable(m_pfc,"REMOTE_ADDR",var,16,false);
+ if (!var.empty())
+ m_remote_addr = var;
+ }
+ return m_remote_addr;
+ }
+ void log(SPLogLevel level, const string& msg) {
+ AbstractSPRequest::log(level,msg);
+ if (level >= SPError)
+ LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, msg.c_str());
+ }
+ void clearHeader(const char* name) {
+ string hdr(!strcmp(name,"REMOTE_USER") ? "remote-user" : name);
+ hdr += ':';
m_pn->SetHeader(m_pfc, const_cast<char*>(hdr.c_str()), "");
}
- virtual void setHeader(const string &name, const string &value) {
- string hdr = name + ":";
- m_pn->SetHeader(m_pfc, const_cast<char*>(hdr.c_str()),
- const_cast<char*>(value.c_str()));
+ void setHeader(const char* name, const char* value) {
+ string hdr(name);
+ hdr += ':';
+ m_pn->SetHeader(m_pfc, const_cast<char*>(hdr.c_str()), const_cast<char*>(value));
}
- virtual string getHeader(const string &name) {
- string hdr = name + ":";
+ string getHeader(const char* name) const {
+ string hdr(name);
+ hdr += ':';
dynabuf buf(1024);
GetHeader(m_pn, m_pfc, const_cast<char*>(hdr.c_str()), buf, 1024, false);
return string(buf);
}
- virtual void setRemoteUser(const string &user) {
- setHeader(string("remote-user"), user);
+ void setRemoteUser(const char* user) {
+ setHeader("remote-user", user);
}
- virtual string getRemoteUser(void) {
- return getHeader(string("remote-user"));
+ string getRemoteUser() const {
+ return getHeader("remote-user");
}
- virtual void* sendPage(
- const string& msg,
- int code=200,
- const string& content_type="text/html",
- const Iterator<header_t>& headers=EMPTY(header_t)) {
- string hdr = string ("Connection: close\r\nContent-type: ") + content_type + "\r\n";
- while (headers.hasNext()) {
- const header_t& h=headers.next();
- hdr += h.first + ": " + h.second + "\r\n";
- }
+ void setResponseHeader(const char* name, const char* value) {
+ // Set for later.
+ if (value)
+ m_headers[name] = value;
+ else
+ m_headers.erase(name);
+ }
+ long sendResponse(istream& in, long status) {
+ string hdr = string("Connection: close\r\n");
+ for (map<string,string>::const_iterator i=m_headers.begin(); i!=m_headers.end(); ++i)
+ hdr += i->first + ": " + i->second + "\r\n";
hdr += "\r\n";
const char* codestr="200 OK";
- switch (code) {
- case 403: codestr="403 Forbidden"; break;
- case 404: codestr="404 Not Found"; break;
- case 500: codestr="500 Server Error"; break;
+ switch (status) {
+ case SAML_HTTP_STATUS_FORBIDDEN:codestr="403 Forbidden"; break;
+ case SAML_HTTP_STATUS_NOTFOUND: codestr="404 Not Found"; break;
+ case SAML_HTTP_STATUS_ERROR: codestr="500 Server Error"; break;
}
m_pfc->ServerSupportFunction(m_pfc, SF_REQ_SEND_RESPONSE_HEADER, (void*)codestr, (DWORD)hdr.c_str(), 0);
- DWORD resplen = msg.size();
- m_pfc->WriteClient(m_pfc, (LPVOID)msg.c_str(), &resplen, 0);
- return (void*)SF_STATUS_REQ_FINISHED;
+ char buf[1024];
+ while (in) {
+ in.read(buf,1024);
+ DWORD resplen = in.gcount();
+ m_pfc->WriteClient(m_pfc, buf, &resplen, 0);
+ }
+ return SF_STATUS_REQ_FINISHED;
}
- virtual void* sendRedirect(const string& url) {
+ long sendRedirect(const char* url) {
// XXX: Don't support the httpRedirect option, yet.
- string hdrs=m_cookie + string("Location: ") + url + "\r\n"
+ string hdr=string("Location: ") + url + "\r\n"
"Content-Type: text/html\r\n"
"Content-Length: 40\r\n"
"Expires: 01-Jan-1997 12:00:00 GMT\r\n"
- "Cache-Control: private,no-store,no-cache\r\n\r\n";
- m_pfc->ServerSupportFunction(m_pfc, SF_REQ_SEND_RESPONSE_HEADER,
- "302 Please Wait", (DWORD)hdrs.c_str(), 0);
+ "Cache-Control: private,no-store,no-cache\r\n";
+ for (map<string,string>::const_iterator i=m_headers.begin(); i!=m_headers.end(); ++i)
+ hdr += i->first + ": " + i->second + "\r\n";
+ hdr += "\r\n";
+ m_pfc->ServerSupportFunction(m_pfc, SF_REQ_SEND_RESPONSE_HEADER, "302 Please Wait", (DWORD)hdr.c_str(), 0);
static const char* redmsg="<HTML><BODY>Redirecting...</BODY></HTML>";
DWORD resplen=40;
m_pfc->WriteClient(m_pfc, (LPVOID)redmsg, &resplen, 0);
- return reinterpret_cast<void*>(SF_STATUS_REQ_FINISHED);
+ return SF_STATUS_REQ_FINISHED;
+ }
+ long returnDecline() {
+ return SF_STATUS_REQ_NEXT_NOTIFICATION;
+ }
+ long returnOK() {
+ return SF_STATUS_REQ_NEXT_NOTIFICATION;
}
- // XXX: We might not ever hit the 'decline' status in this filter.
- //virtual void* returnDecline(void) { }
- virtual void* returnOK(void) { return (void*) SF_STATUS_REQ_NEXT_NOTIFICATION; }
- // The filter never processes the POST, so stub these methods.
- virtual void setCookie(const string &name, const string &value) {
- // Set the cookie for later. Use it during the redirect.
- m_cookie += "Set-Cookie: " + name + "=" + value + "\r\n";
+ const vector<XSECCryptoX509*>& getClientCertificates() const {
+ return m_certs;
}
- virtual string getArgs(void) { throw runtime_error("getArgs not implemented"); }
- virtual string getPostData(void) { throw runtime_error("getPostData not implemented"); }
+
+ // The filter never processes the POST, so stub these methods.
+ const char* getQueryString() const { throw runtime_error("getQueryString not implemented"); }
+ const char* getRequestBody() const { throw runtime_error("getRequestBody not implemented"); }
};
DWORD WriteClientError(PHTTP_FILTER_CONTEXT pfc, const char* msg)
ostringstream threadid;
threadid << "[" << getpid() << "] isapi_shib" << '\0';
- saml::NDC ndc(threadid.str().c_str());
+ xmltooling::NDC ndc(threadid.str().c_str());
ShibTargetIsapiF stf(pfc, pn, map_i->second);
// "false" because we don't override the Shib settings
- pair<bool,void*> res = stf.doCheckAuthN();
- if (res.first) return (DWORD)res.second;
+ pair<bool,long> res = stf.getServiceProvider().doAuthentication(stf);
+ if (res.first) return res.second;
// "false" because we don't override the Shib settings
- res = stf.doExportAssertions();
- if (res.first) return (DWORD)res.second;
+ res = stf.getServiceProvider().doExport(stf);
+ if (res.first) return res.second;
- res = stf.doCheckAuthZ();
- if (res.first) return (DWORD)res.second;
+ res = stf.getServiceProvider().doAuthorization(stf);
+ if (res.first) return res.second;
return SF_STATUS_REQ_NEXT_NOTIFICATION;
}
else
return WriteClientError(pfc,"Shibboleth Filter detected unexpected IIS error.");
}
- catch (SAMLException& e) {
+ catch (exception& e) {
LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, e.what());
return WriteClientError(pfc,"Shibboleth Filter caught an exception, check Event Log for details.");
}
}
-class ShibTargetIsapiE : public ShibTarget
+class ShibTargetIsapiE : public AbstractSPRequest
{
LPEXTENSION_CONTROL_BLOCK m_lpECB;
- string m_cookie;
+ map<string,string> m_headers;
+ vector<XSECCryptoX509*> m_certs;
+ mutable string m_body;
+ mutable bool m_gotBody;
+ int m_port;
+ string m_scheme,m_hostname,m_uri;
+ mutable string m_remote_addr;
public:
- ShibTargetIsapiE(LPEXTENSION_CONTROL_BLOCK lpECB, const site_t& site) {
+ ShibTargetIsapiE(LPEXTENSION_CONTROL_BLOCK lpECB, const site_t& site) : m_lpECB(lpECB), m_gotBody(false) {
dynabuf ssl(5);
GetServerVariable(lpECB,"HTTPS",ssl,5);
bool SSL=(ssl=="on" || ssl=="ON");
+ // Scheme may come from site def or be derived from IIS.
+ m_scheme=site.m_scheme;
+ if (m_scheme.empty() || !g_bNormalizeRequest)
+ m_scheme = SSL ? "https" : "http";
+
// URL path always come from IIS.
dynabuf url(256);
GetServerVariable(lpECB,"URL",url,255);
strncpy(port,site.m_port.c_str(),10);
static_cast<char*>(port)[10]=0;
}
+ m_port = atoi(port);
- // Scheme may come from site def or be derived from IIS.
- const char* scheme=site.m_scheme.c_str();
- if (!scheme || !*scheme || !g_bNormalizeRequest) {
- scheme = SSL ? "https" : "http";
- }
-
- // Get the other server variables.
- dynabuf remote_addr(16),hostname(32);
- GetServerVariable(lpECB, "REMOTE_ADDR", remote_addr, 16);
- GetServerVariable(lpECB, "SERVER_NAME", hostname, 32);
+ dynabuf var(32);
+ GetServerVariable(lpECB, "SERVER_NAME", var, 32);
// Make sure SERVER_NAME is "authorized" for use on this site. If not, set to canonical name.
- const char* host=hostname;
- if (site.m_name!=host && site.m_aliases.find(host)==site.m_aliases.end())
- host=site.m_name.c_str();
+ m_hostname=var;
+ if (site.m_name!=m_hostname && site.m_aliases.find(m_hostname)==site.m_aliases.end())
+ m_hostname=site.m_name;
/*
* IIS screws us over on PATH_INFO (the hits keep on coming). We need to figure out if
* PathInfo: /SAML/POST
*/
- string fullurl;
-
// Clearly we're only in bad mode if path info exists at all.
if (lpECB->lpszPathInfo && *(lpECB->lpszPathInfo)) {
if (strstr(lpECB->lpszPathInfo,url))
// Pretty good chance we're in bad mode, unless the PathInfo repeats the path itself.
- fullurl=lpECB->lpszPathInfo;
+ m_uri = lpECB->lpszPathInfo;
else {
- fullurl+=url;
- fullurl+=lpECB->lpszPathInfo;
+ m_uri = url;
+ m_uri += lpECB->lpszPathInfo;
}
}
// For consistency with Apache, let's add the query string.
if (lpECB->lpszQueryString && *(lpECB->lpszQueryString)) {
- fullurl+='?';
- fullurl+=lpECB->lpszQueryString;
+ m_uri += '?';
+ m_uri += lpECB->lpszQueryString;
}
- init(scheme, host, atoi(port), fullurl.c_str(), lpECB->lpszContentType, remote_addr, lpECB->lpszMethod);
-
- m_lpECB = lpECB;
}
~ShibTargetIsapiE() { }
- virtual void log(ShibLogLevel level, const string &msg) {
- ShibTarget::log(level,msg);
- if (level == LogLevelError)
+ const char* getScheme() const {
+ return m_scheme.c_str();
+ }
+ const char* getHostname() const {
+ return m_hostname.c_str();
+ }
+ int getPort() const {
+ return m_port;
+ }
+ const char* getRequestURI() const {
+ return m_uri.c_str();
+ }
+ const char* getMethod() const {
+ return m_lpECB->lpszMethod;
+ }
+ string getContentType() const {
+ return m_lpECB->lpszContentType ? m_lpECB->lpszContentType : "";
+ }
+ long getContentLength() const {
+ return m_lpECB->cbTotalBytes;
+ }
+ string getRemoteAddr() const {
+ if (m_remote_addr.empty()) {
+ dynabuf var(16);
+ GetServerVariable(m_lpECB, "REMOTE_ADDR", var, 16, false);
+ if (!var.empty())
+ m_remote_addr = var;
+ }
+ return m_remote_addr;
+ }
+ void log(SPLogLevel level, const string& msg) {
+ AbstractSPRequest::log(level,msg);
+ if (level >= SPError)
LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, msg.c_str());
}
- virtual string getCookies() const {
+ string getHeader(const char* name) const {
+ string hdr("HTTP_");
+ for (; *name; ++name) {
+ if (*name=='-')
+ hdr += '_';
+ else
+ hdr += toupper(*name);
+ }
dynabuf buf(128);
- GetServerVariable(m_lpECB, "HTTP_COOKIE", buf, 128, false);
+ GetServerVariable(m_lpECB, const_cast<char*>(hdr.c_str()), buf, 128, false);
return buf.empty() ? "" : buf;
}
- virtual void setCookie(const string &name, const string &value) {
- // Set the cookie for later. Use it during the redirect.
- m_cookie += "Set-Cookie: " + name + "=" + value + "\r\n";
+ void setResponseHeader(const char* name, const char* value) {
+ // Set for later.
+ if (value)
+ m_headers[name] = value;
+ else
+ m_headers.erase(name);
}
- virtual string getArgs(void) {
- return string(m_lpECB->lpszQueryString ? m_lpECB->lpszQueryString : "");
+ const char* getQueryString() const {
+ return m_lpECB->lpszQueryString;
}
- virtual string getPostData(void) {
+ const char* getRequestBody() const {
+ if (m_gotBody)
+ return m_body.c_str();
if (m_lpECB->cbTotalBytes > 1024*1024) // 1MB?
- throw FatalProfileException("Blocked too-large a submission to profile endpoint.");
+ throw opensaml::BindingException("Size of POST request body exceeded limit.");
else if (m_lpECB->cbTotalBytes != m_lpECB->cbAvailable) {
- string cgistr;
+ m_gotBody=true;
char buf[8192];
DWORD datalen=m_lpECB->cbTotalBytes;
while (datalen) {
DWORD buflen=8192;
BOOL ret = m_lpECB->ReadClient(m_lpECB->ConnID, buf, &buflen);
if (!ret || !buflen)
- throw FatalProfileException("Error reading profile submission from browser.");
- cgistr.append(buf, buflen);
+ throw saml::SAMLException("Error reading POST request body from browser.");
+ m_body.append(buf, buflen);
datalen-=buflen;
}
- return cgistr;
}
- else
- return string(reinterpret_cast<char*>(m_lpECB->lpbData),m_lpECB->cbAvailable);
- }
- virtual void* sendPage(
- const string &msg,
- int code=200,
- const string& content_type="text/html",
- const Iterator<header_t>& headers=EMPTY(header_t)) {
- string hdr = string ("Connection: close\r\nContent-type: ") + content_type + "\r\n";
- for (unsigned int k = 0; k < headers.size(); k++) {
- hdr += headers[k].first + ": " + headers[k].second + "\r\n";
+ else {
+ m_gotBody=true;
+ m_body.assign(reinterpret_cast<char*>(m_lpECB->lpbData),m_lpECB->cbAvailable);
}
+ return m_body.c_str();
+ }
+ long sendResponse(istream& in, long status) {
+ string hdr = string("Connection: close\r\n");
+ for (map<string,string>::const_iterator i=m_headers.begin(); i!=m_headers.end(); ++i)
+ hdr += i->first + ": " + i->second + "\r\n";
hdr += "\r\n";
const char* codestr="200 OK";
- switch (code) {
- case 403: codestr="403 Forbidden"; break;
- case 404: codestr="404 Not Found"; break;
- case 500: codestr="500 Server Error"; break;
+ switch (status) {
+ case SAML_HTTP_STATUS_FORBIDDEN:codestr="403 Forbidden"; break;
+ case SAML_HTTP_STATUS_NOTFOUND: codestr="404 Not Found"; break;
+ case SAML_HTTP_STATUS_ERROR: codestr="500 Server Error"; break;
}
m_lpECB->ServerSupportFunction(m_lpECB->ConnID, HSE_REQ_SEND_RESPONSE_HEADER, (void*)codestr, 0, (LPDWORD)hdr.c_str());
- DWORD resplen = msg.size();
- m_lpECB->WriteClient(m_lpECB->ConnID, (LPVOID)msg.c_str(), &resplen, HSE_IO_SYNC);
- return (void*)HSE_STATUS_SUCCESS;
+ char buf[1024];
+ while (in) {
+ in.read(buf,1024);
+ DWORD resplen = in.gcount();
+ m_lpECB->WriteClient(m_lpECB->ConnID, buf, &resplen, HSE_IO_SYNC);
+ }
+ return HSE_STATUS_SUCCESS;
}
- virtual void* sendRedirect(const string& url) {
- // XXX: Don't support the httpRedirect option, yet.
- string hdrs = m_cookie + "Location: " + url + "\r\n"
+ long sendRedirect(const char* url) {
+ string hdr=string("Location: ") + url + "\r\n"
"Content-Type: text/html\r\n"
"Content-Length: 40\r\n"
"Expires: 01-Jan-1997 12:00:00 GMT\r\n"
- "Cache-Control: private,no-store,no-cache\r\n\r\n";
- m_lpECB->ServerSupportFunction(m_lpECB->ConnID, HSE_REQ_SEND_RESPONSE_HEADER,
- "302 Moved", 0, (LPDWORD)hdrs.c_str());
+ "Cache-Control: private,no-store,no-cache\r\n";
+ for (map<string,string>::const_iterator i=m_headers.begin(); i!=m_headers.end(); ++i)
+ hdr += i->first + ": " + i->second + "\r\n";
+ hdr += "\r\n";
+ m_lpECB->ServerSupportFunction(m_lpECB->ConnID, HSE_REQ_SEND_RESPONSE_HEADER, "302 Moved", 0, (LPDWORD)hdr.c_str());
static const char* redmsg="<HTML><BODY>Redirecting...</BODY></HTML>";
DWORD resplen=40;
m_lpECB->WriteClient(m_lpECB->ConnID, (LPVOID)redmsg, &resplen, HSE_IO_SYNC);
- return (void*)HSE_STATUS_SUCCESS;
+ return HSE_STATUS_SUCCESS;
}
// Decline happens in the POST processor if this isn't the shire url
// Note that it can also happen with HTAccess, but we don't support that, yet.
- virtual void* returnDecline(void) {
- return (void*)
- WriteClientError(m_lpECB, "ISAPI extension can only be invoked to process Shibboleth protocol requests."
- "Make sure the mapped file extension doesn't match actual content.");
+ long returnDecline() {
+ return WriteClientError(
+ m_lpECB,
+ "ISAPI extension can only be invoked to process Shibboleth protocol requests."
+ "Make sure the mapped file extension doesn't match actual content."
+ );
+ }
+ long returnOK() {
+ return HSE_STATUS_SUCCESS;
+ }
+
+ const vector<XSECCryptoX509*>& getClientCertificates() const {
+ return m_certs;
}
- virtual void* returnOK(void) { return (void*) HSE_STATUS_SUCCESS; }
// Not used in the extension.
- virtual void clearHeader(const string &name) { throw runtime_error("clearHeader not implemented"); }
- virtual void setHeader(const string &name, const string &value) { throw runtime_error("setHeader not implemented"); }
- virtual string getHeader(const string &name) { throw runtime_error("getHeader not implemented"); }
- virtual void setRemoteUser(const string &user) { throw runtime_error("setRemoteUser not implemented"); }
- virtual string getRemoteUser(void) { throw runtime_error("getRemoteUser not implemented"); }
+ virtual void clearHeader(const char* name) { throw runtime_error("clearHeader not implemented"); }
+ virtual void setHeader(const char* name, const char* value) { throw runtime_error("setHeader not implemented"); }
+ virtual void setRemoteUser(const char* user) { throw runtime_error("setRemoteUser not implemented"); }
+ virtual string getRemoteUser() const { throw runtime_error("getRemoteUser not implemented"); }
};
extern "C" DWORD WINAPI HttpExtensionProc(LPEXTENSION_CONTROL_BLOCK lpECB)
{
- string targeturl;
- const IApplication* application=NULL;
try {
ostringstream threadid;
threadid << "[" << getpid() << "] isapi_shib_extension" << '\0';
- saml::NDC ndc(threadid.str().c_str());
+ xmltooling::NDC ndc(threadid.str().c_str());
// Determine web site number. This can't really fail, I don't think.
dynabuf buf(128);
return WriteClientError(lpECB, "Shibboleth Extension not configured for this web site.");
ShibTargetIsapiE ste(lpECB, map_i->second);
- pair<bool,void*> res = ste.doHandler();
- if (res.first) return (DWORD)res.second;
+ pair<bool,long> res = ste.getServiceProvider().doHandler(ste);
+ if (res.first) return res.second;
return WriteClientError(lpECB, "Shibboleth Extension failed to process request");
else
return WriteClientError(lpECB,"Server detected unexpected IIS error.");
}
- catch (SAMLException& e) {
+ catch (exception& e) {
LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, e.what());
return WriteClientError(lpECB,"Shibboleth Extension caught an exception, check Event Log for details.");
}