/*
- * The Shibboleth License, Version 1.
- * Copyright (c) 2002
- * University Corporation for Advanced Internet Development, Inc.
- * All rights reserved
+ * Copyright 2001-2007 Internet2
*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
*
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are met:
+ * http://www.apache.org/licenses/LICENSE-2.0
*
- * Redistributions of source code must retain the above copyright notice, this
- * list of conditions and the following disclaimer.
- *
- * Redistributions in binary form must reproduce the above copyright notice,
- * this list of conditions and the following disclaimer in the documentation
- * and/or other materials provided with the distribution, if any, must include
- * the following acknowledgment: "This product includes software developed by
- * the University Corporation for Advanced Internet Development
- * <http://www.ucaid.edu>Internet2 Project. Alternately, this acknowledegement
- * may appear in the software itself, if and wherever such third-party
- * acknowledgments normally appear.
- *
- * Neither the name of Shibboleth nor the names of its contributors, nor
- * Internet2, nor the University Corporation for Advanced Internet Development,
- * Inc., nor UCAID may be used to endorse or promote products derived from this
- * software without specific prior written permission. For written permission,
- * please contact shibboleth@shibboleth.org
- *
- * Products derived from this software may not be called Shibboleth, Internet2,
- * UCAID, or the University Corporation for Advanced Internet Development, nor
- * may Shibboleth appear in their name, without prior written permission of the
- * University Corporation for Advanced Internet Development.
- *
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
- * AND WITH ALL FAULTS. ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
- * PARTICULAR PURPOSE, AND NON-INFRINGEMENT ARE DISCLAIMED AND THE ENTIRE RISK
- * OF SATISFACTORY QUALITY, PERFORMANCE, ACCURACY, AND EFFORT IS WITH LICENSEE.
- * IN NO EVENT SHALL THE COPYRIGHT OWNER, CONTRIBUTORS OR THE UNIVERSITY
- * CORPORATION FOR ADVANCED INTERNET DEVELOPMENT, INC. BE LIABLE FOR ANY DIRECT,
- * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
*/
/*
#ifndef SHIB_TARGET_H
#define SHIB_TARGET_H
+// New headers
+#include <shibsp/Application.h>
+#include <shibsp/Handler.h>
+#include <shibsp/RequestMapper.h>
+#include <shibsp/ServiceProvider.h>
+#include <shibsp/SessionCache.h>
+#include <shibsp/remoting/ListenerService.h>
+
+// Old headers
#include <saml/saml.h>
#include <shib/shib.h>
-#include <shib/shib-threads.h>
#ifdef WIN32
# ifndef SHIBTARGET_EXPORTS
# define SHIBTARGET_EXPORTS __declspec(dllimport)
# endif
-# define SHIB_SCHEMAS "/opt/shibboleth/share/xml/shibboleth"
-# define SHIB_CONFIG "/opt/shibboleth/etc/shibboleth/shibboleth.xml"
+# define SHIB_SCHEMAS "/opt/shibboleth-sp/share/xml/shibboleth"
+# define SHIB_CONFIG "/opt/shibboleth-sp/etc/shibboleth/shibboleth.xml"
#else
# include <shib-target/shib-paths.h>
# define SHIBTARGET_EXPORTS
#endif
-#include <shib-target/shibrpc.h>
-
namespace shibtarget {
- //******************************************************************************
- // You probably don't care about much below this line
- // unless you are using the lower-layer APIs provided by
- // the shib target library. Go to the end of the file to
- // find the ShibTarget class -- you probably wnat to use that.
- //
-
- class SHIBTARGET_EXPORTS ShibTargetException : public std::exception
- {
- public:
- explicit ShibTargetException() : m_code(SHIBRPC_OK) {}
- explicit ShibTargetException(ShibRpcStatus code, const char* msg, const shibboleth::IEntityDescriptor* provider);
- explicit ShibTargetException(ShibRpcStatus code, const char* msg, const shibboleth::IRoleDescriptor* role=NULL);
-
- virtual ~ShibTargetException() throw () {}
- virtual ShibRpcStatus which() const throw () { return m_code; }
- virtual const char* what() const throw () { return m_msg.c_str(); }
- virtual const char* syswho() const throw() { return m_providerId.c_str(); }
- virtual const char* where() const throw () { return m_errorURL.c_str(); }
- virtual const char* who() const throw () { return m_contact.c_str(); }
- virtual const char* how() const throw () { return m_email.c_str(); }
-
- private:
- ShibRpcStatus m_code;
- std::string m_msg;
- std::string m_providerId;
- std::string m_errorURL;
- std::string m_contact;
- std::string m_email;
- };
-
- class RPCErrorPriv;
- class SHIBTARGET_EXPORTS RPCError
- {
- public:
- RPCError();
- RPCError(ShibRpcError* e);
- RPCError(int s, const char* st);
- RPCError(ShibTargetException &exp);
- ~RPCError();
-
- bool isError();
- bool isRetryable();
-
- // Return a set of strings that correspond to the error properties
- const char* getType();
- const char* getText();
- const char* getDesc();
- const char* getProviderId();
- const char* getErrorURL();
- const char* getContactName();
- const char* getContactEmail();
- int getCode();
-
- private:
- RPCErrorPriv* m_priv;
- };
-
// Abstract APIs for access to configuration information
- struct SHIBTARGET_EXPORTS IPropertySet
+ /**
+ * Interface to Shibboleth Applications, which exposes most of the functionality
+ * required to process web requests or security protocol messages for resources
+ * associated with them.
+ *
+ * Applications are implementation-specific, but generally correspond to collections
+ * of resources related to one another in logical ways, such as a virtual host or
+ * a Java servlet context. Most complex configuration data is associated with an
+ * Application. Implementations should always expose an application named "default"
+ * as a last resort.
+ */
+ struct SHIBTARGET_EXPORTS IApplication : public virtual shibsp::Application,
+ public virtual shibboleth::ShibBrowserProfile::ITokenValidator
{
- virtual std::pair<bool,bool> getBool(const char* name, const char* ns=NULL) const=0;
- virtual std::pair<bool,const char*> getString(const char* name, const char* ns=NULL) const=0;
- virtual std::pair<bool,const XMLCh*> getXMLString(const char* name, const char* ns=NULL) const=0;
- virtual std::pair<bool,unsigned int> getUnsignedInt(const char* name, const char* ns=NULL) const=0;
- virtual std::pair<bool,int> getInt(const char* name, const char* ns=NULL) const=0;
- virtual const IPropertySet* getPropertySet(const char* name, const char* ns="urn:mace:shibboleth:target:config:1.0") const=0;
- virtual const DOMElement* getElement() const=0;
- virtual ~IPropertySet() {}
- };
-
- struct SHIBTARGET_EXPORTS IListener : public virtual shibboleth::IPlugIn
- {
-#ifdef WIN32
- typedef SOCKET ShibSocket;
-#else
- typedef int ShibSocket;
-#endif
- virtual bool create(ShibSocket& s) const=0;
- virtual bool bind(ShibSocket& s, bool force=false) const=0;
- virtual bool connect(ShibSocket& s) const=0;
- virtual bool close(ShibSocket& s) const=0;
- virtual bool accept(ShibSocket& listener, ShibSocket& s) const=0;
- virtual CLIENT* getClientHandle(ShibSocket& s, u_long program, u_long version) const=0;
- virtual ~IListener() {}
- };
-
- struct SHIBTARGET_EXPORTS IAccessControl : public virtual shibboleth::ILockable, public virtual shibboleth::IPlugIn
- {
- virtual bool authorized(
- const saml::SAMLAuthenticationStatement& authn, const saml::Iterator<saml::SAMLAssertion*>& attrs
+ // caller is borrowing object, must use within scope of config lock
+ virtual const saml::SAMLBrowserProfile* getBrowserProfile() const=0;
+ virtual const saml::SAMLBinding* getBinding(const XMLCh* binding) const=0;
+
+ // caller is given ownership of object, must use and delete within scope of config lock
+ virtual saml::SAMLBrowserProfile::ArtifactMapper* getArtifactMapper() const=0;
+
+ // general token validation based on conditions, signatures, etc.
+ virtual void validateToken(
+ saml::SAMLAssertion* token,
+ time_t t=0,
+ const opensaml::saml2md::RoleDescriptor* role=NULL,
+ const xmltooling::TrustEngine* trust=NULL
) const=0;
- virtual ~IAccessControl() {}
- };
- struct SHIBTARGET_EXPORTS IRequestMapper : public virtual shibboleth::ILockable, public virtual shibboleth::IPlugIn
- {
- typedef std::pair<const IPropertySet*,IAccessControl*> Settings;
- virtual Settings getSettingsFromURL(const char* url) const=0;
- virtual Settings getSettingsFromParsedURL(
- const char* scheme, const char* hostname, unsigned int port, const char* path=NULL
- ) const=0;
- virtual ~IRequestMapper() {}
+ virtual ~IApplication() {}
};
-
- struct SHIBTARGET_EXPORTS IApplication : public virtual IPropertySet
+
+ /**
+ * OpenSAML binding hook
+ *
+ * Instead of wrapping the binding to deal with mutual authentication, we
+ * just use the HTTP hook functionality offered by OpenSAML. The hook will
+ * register "itself" as a globalCtx pointer with the SAML binding and the caller
+ * will declare and pass the embedded struct as callCtx for use by the hook.
+ */
+ class ShibHTTPHook : virtual public saml::SAMLSOAPHTTPBinding::HTTPHook
{
- virtual const char* getId() const=0;
- virtual saml::Iterator<saml::SAMLAttributeDesignator*> getAttributeDesignators() const=0;
- virtual saml::Iterator<shibboleth::IAAP*> getAAPProviders() const=0;
- virtual saml::Iterator<shibboleth::IMetadata*> getMetadataProviders() const=0;
- virtual saml::Iterator<shibboleth::ITrust*> getTrustProviders() const=0;
- virtual saml::Iterator<shibboleth::IRevocation*> getRevocationProviders() const=0;
- virtual saml::Iterator<const XMLCh*> getAudiences() const=0;
- virtual const char* getTLSCred(const shibboleth::IEntityDescriptor* provider) const=0;
- virtual const char* getSigningCred(const shibboleth::IEntityDescriptor* provider) const=0;
- virtual ~IApplication() {}
+ public:
+ ShibHTTPHook(const xmltooling::TrustEngine* trust) : m_trust(trust) {}
+ virtual ~ShibHTTPHook() {}
+
+ // Only hook we need here is for outgoing connection to server.
+ virtual bool outgoing(saml::HTTPClient* conn, void* globalCtx=NULL, void* callCtx=NULL);
+
+ // Client declares a context object and pass as callCtx to send() method.
+ class ShibHTTPHookCallContext {
+ public:
+ ShibHTTPHookCallContext(const shibsp::PropertySet* credUse, const opensaml::saml2md::RoleDescriptor* role)
+ : m_credUse(credUse), m_role(role), m_hook(NULL), m_authenticated(false) {}
+ const ShibHTTPHook* getHook() {return m_hook;}
+ const shibsp::PropertySet* getCredentialUse() {return m_credUse;}
+ const opensaml::saml2md::RoleDescriptor* getRoleDescriptor() {return m_role;}
+ bool isAuthenticated() const {return m_authenticated;}
+ void setAuthenticated() {m_authenticated=true;}
+
+ private:
+ const shibsp::PropertySet* m_credUse;
+ const opensaml::saml2md::RoleDescriptor* m_role;
+ ShibHTTPHook* m_hook;
+ bool m_authenticated;
+ friend class ShibHTTPHook;
+ };
+
+ const xmltooling::TrustEngine* getTrustEngine() const {return m_trust;}
+ private:
+ const xmltooling::TrustEngine* m_trust;
};
- struct SHIBTARGET_EXPORTS ISessionCacheEntry : public virtual shibboleth::ILockable
+ /**
+ * Interface to a cached user session.
+ *
+ * Cache entries provide implementations with access to the raw SAML information they
+ * need to publish or provide access to the data for applications to use. All creation
+ * or access to entries is through the ISessionCache interface, and callers must unlock
+ * the entry when finished using it, rather than explicitly freeing them.
+ */
+ struct SHIBTARGET_EXPORTS ISessionCacheEntry : public virtual saml::ILockable
{
- virtual bool isValid(time_t lifetime, time_t timeout) const=0;
virtual const char* getClientAddress() const=0;
- virtual const char* getSerializedStatement() const=0;
- virtual const saml::SAMLAuthenticationStatement* getStatement() const=0;
- virtual void preFetch(int prefetch_window)=0;
- virtual saml::Iterator<saml::SAMLAssertion*> getAssertions()=0;
+ virtual const char* getProviderId() const=0;
+ virtual std::pair<const char*,const saml::SAMLSubject*> getSubject(bool xml=true, bool obj=false) const=0;
+ virtual const char* getAuthnContext() const=0;
+ virtual std::pair<const char*,const saml::SAMLResponse*> getTokens(bool xml=true, bool obj=false) const=0;
+ virtual std::pair<const char*,const saml::SAMLResponse*> getFilteredTokens(bool xml=true, bool obj=false) const=0;
virtual ~ISessionCacheEntry() {}
};
- struct SHIBTARGET_EXPORTS ISessionCache : public virtual shibboleth::IPlugIn
+ /**
+ * Interface to a sink for session cache events.
+ *
+ * All caches support registration of a backing store that can be informed
+ * of significant events in the lifecycle of a cache entry.
+ */
+ struct SHIBTARGET_EXPORTS ISessionCacheStore
{
- virtual void thread_init()=0;
- virtual void thread_end()=0;
- virtual std::string generateKey() const=0;
- virtual void insert(
+ virtual HRESULT onCreate(
const char* key,
const IApplication* application,
- saml::SAMLAuthenticationStatement *s,
- const char* client_addr,
- saml::SAMLResponse* r=NULL,
- const shibboleth::IRoleDescriptor* source=NULL
+ const ISessionCacheEntry* entry,
+ int majorVersion,
+ int minorVersion,
+ time_t created
)=0;
- virtual ISessionCacheEntry* find(const char* key, const IApplication* application)=0;
- virtual void remove(const char* key)=0;
- virtual ~ISessionCache() {}
- };
-
- struct SHIBTARGET_EXPORTS IConfig : public virtual shibboleth::ILockable, public virtual IPropertySet, public virtual shibboleth::IPlugIn
- {
- virtual const IListener* getListener() const=0;
- virtual ISessionCache* getSessionCache() const=0;
- virtual IRequestMapper* getRequestMapper() const=0;
- virtual const IApplication* getApplication(const char* applicationId) const=0;
- virtual saml::Iterator<shibboleth::ICredentials*> getCredentialsProviders() const=0;
- virtual ~IConfig() {}
- };
-
- class SHIBTARGET_EXPORTS ShibTargetConfig
- {
- public:
- ShibTargetConfig() : m_ini(NULL), m_features(0) {}
- virtual ~ShibTargetConfig() {}
-
- virtual bool init(const char* schemadir, const char* config) = 0;
- virtual void shutdown() = 0;
-
- enum components_t {
- Listener = 1,
- SessionCache = 2,
- Metadata = 4,
- Trust = 8,
- Credentials = 16,
- AAP = 32,
- RequestMapper = 64,
- SHARExtensions = 128,
- SHIREExtensions = 256,
- Logging = 512
- };
- void setFeatures(long enabled) {m_features = enabled;}
- bool isEnabled(components_t feature) {return (m_features & feature)>0;}
- virtual IConfig* getINI() const {return m_ini;}
-
- static const XMLCh SHIBTARGET_NS[];
- static ShibTargetConfig& getConfig();
-
- protected:
- IConfig* m_ini;
-
- private:
- unsigned long m_features;
+ virtual HRESULT onRead(
+ const char* key,
+ std::string& applicationId,
+ std::string& clientAddress,
+ std::string& providerId,
+ std::string& subject,
+ std::string& authnContext,
+ std::string& tokens,
+ int& majorVersion,
+ int& minorVersion,
+ time_t& created,
+ time_t& accessed
+ )=0;
+ virtual HRESULT onRead(const char* key, time_t& accessed)=0;
+ virtual HRESULT onRead(const char* key, std::string& tokens)=0;
+ virtual HRESULT onUpdate(const char* key, const char* tokens=NULL, time_t lastAccess=0)=0;
+ virtual HRESULT onDelete(const char* key)=0;
+ virtual ~ISessionCacheStore() {}
};
- class SHIBTARGET_EXPORTS RM
+ /**
+ * Interface to the session cache.
+ *
+ * The session cache abstracts a persistent (meaning across requests) cache of
+ * instances of the ISessionCacheEntry interface. Creation of new entries and entry
+ * lookup are confined to this interface to enable implementations to flexibly
+ * remote and/or optimize calls by implementing custom versions of the
+ * ISessionCacheEntry interface as required.
+ */
+ struct SHIBTARGET_EXPORTS ISessionCache : virtual public shibsp::SessionCache
{
- public:
- RM(const IApplication* app) : m_app(app) {}
- ~RM() {}
-
- RPCError* getAssertions(
- const char* cookie,
- const char* ip,
- std::vector<saml::SAMLAssertion*>& assertions,
- saml::SAMLAuthenticationStatement **statement = NULL
- );
- static void serialize(saml::SAMLAssertion &assertion, std::string &result);
-
- private:
- const IApplication* m_app;
- };
-
- class ShibMLPPriv;
- class SHIBTARGET_EXPORTS ShibMLP {
- public:
- ShibMLP();
- ~ShibMLP();
-
- void insert (const std::string& key, const std::string& value);
- void insert (const std::string& key, const char* value) {
- std::string v = value;
- insert (key, v);
- }
- void insert (const char* key, const std::string& value) {
- std::string k = key;
- insert (k, value);
- }
- void insert (const char* key, const char* value) {
- std::string k = key, v = value;
- insert(k,v);
- }
- void insert (RPCError& e);
-
- void clear () { m_map.clear(); }
-
- const char* run (std::istream& s, const IPropertySet* props=NULL, std::string* output=NULL);
- const char* run (const std::string& input, const IPropertySet* props=NULL, std::string* output=NULL);
- const char* run (const char* input, const IPropertySet* props=NULL, std::string* output=NULL) {
- std::string i = input;
- return run(i,props,output);
- }
-
- private:
- ShibMLPPriv *m_priv;
- std::map<std::string,std::string> m_map;
- std::string m_generated;
- };
-
- //******************************************************************************
- //
- // This is the interface you're looking for.
- //
-
- // This usurps the existing SHIRE and RM apis into a single class.
- class ShibTargetPriv;
- class SHIBTARGET_EXPORTS ShibTarget {
- public:
- ShibTarget(const IApplication *app);
- virtual ~ShibTarget(void);
+ virtual std::string insert(
+ const IApplication* application,
+ const opensaml::saml2md::RoleDescriptor* source,
+ const char* client_addr,
+ const saml::SAMLSubject* subject,
+ const char* authnContext,
+ const saml::SAMLResponse* tokens
+ )=0;
+ virtual ISessionCacheEntry* find(
+ const char* key, const IApplication* application, const char* client_addr
+ )=0;
+ virtual void remove(
+ const char* key, const IApplication* application, const char* client_addr
+ )=0;
- // These are defined here so the subclass does not need to specifically
- // depend on log4cpp. We could use log4cpp::Priority::PriorityLevel
- // but this is just as easy, IMHO. It's just a case statement in the
- // implementation to handle the event level.
- enum ShibLogLevel {
- LogLevelDebug,
- LogLevelInfo,
- LogLevelWarn,
- LogLevelError
+ virtual bool setBackingStore(ISessionCacheStore* store)=0;
+ virtual ~ISessionCache() {}
};
- //
- // Note: subclasses MUST implement ALL of these virtual methods
- //
-
- // Send a message to the Webserver log
- virtual void log(ShibLogLevel level, const std::string &msg);
-
- void log(ShibLogLevel level, const char *msg) {
- std::string s = msg;
- log(level, s);
- }
-
- // Get/Set a cookie for this connection
- virtual std::string getCookies(void);
- virtual void setCookie(const std::string &name, const std::string &value);
-
- void setCookie(const char *name, const char *value) {
- std::string ns = name;
- std::string vs = value;
- setCookie(ns, vs);
- }
- void setCookie(const char *name, const std::string &value) {
- std::string ns = name;
- setCookie(ns, value);
- }
-
-
- // Get the request's GET arguments or POST data from the server
- virtual std::string getArgs(void);
- virtual std::string getPostData(void);
-
- // Clear a header, set a header
- // These APIs are used for exporting the Assertions into the
- // Headers. It will clear some well-known headers first to make
- // sure none remain. Then it will process the set of assertions
- // and export them via setHeader().
- virtual void clearHeader(const std::string &name);
- virtual void setHeader(const std::string &name, const std::string &value);
- virtual std::string getHeader(const std::string &name);
- virtual void setRemoteUser(const std::string &user);
-
- void clearHeader(const char *n) {
- std::string s = n;
- clearHeader(s);
- }
- void setHeader(const char *n, const char *v) {
- std::string ns = n;
- std::string vs = v;
- setHeader(ns, vs);
- }
- void setHeader(const std::string &n, const char *v) {
- std::string vs = v;
- setHeader(n, vs);
- }
- void setHeader(const char *n, const std::string &v) {
- std::string ns = n;
- setHeader(ns, v);
- }
- std::string getHeader(const char *n) {
- std::string s = n;
- return getHeader(s);
- }
- void setRemoteUser(const char *n) {
- std::string s = n;
- setRemoteUser(s);
- }
-
- // Not sure if I need these, but I might for something like Apache
- // in order to "fix" the auth type in the case of basicHijack. In
- // particular we need to maintain some state between the different
- // APIs to know whether or not to proceed with shib processing.
- virtual std::string getAuthType(void);
- virtual void setAuthType(const std::string);
-
- void setAuthType(const char *type) {
- std::string s = type;
- setAuthType(s);
- }
-
- virtual std::pair<bool,bool> getRequireSession(IRequestMapper::Settings &settings);
-
- // Note: we still need to define exactly what kind of data in contained
- // in the HTAccessInfo -- perhaps we can stub it out so non-htaccess
- // systems have something they can plug in?
- //virtual HTAccessInfo& getAccessInfo(void);
-
- // We're done. Finish up. Send either a result (error?) page or a redirect.
- // If there are no headers supplied assume the content-type == text/html
- virtual void* sendPage(
- const std::string &msg,
- const std::pair<std::string, std::string> headers[] = NULL,
- int code = 200
- );
- void* sendPage(const char *msg) {
- std::string m = msg;
- return sendPage(m);
- }
+ #define MEMORY_SESSIONCACHE "edu.internet2.middleware.shibboleth.sp.provider.MemorySessionCacheProvider"
+ #define MYSQL_SESSIONCACHE "edu.internet2.middleware.shibboleth.sp.provider.MySQLSessionCacheProvider"
+ #define ODBC_SESSIONCACHE "edu.internet2.middleware.shibboleth.sp.provider.ODBCSessionCacheProvider"
- virtual void* sendRedirect(const std::string url);
+ #define MYSQL_REPLAYCACHE "edu.internet2.middleware.shibboleth.sp.provider.MySQLReplayCacheProvider"
+ #define ODBC_REPLAYCACHE "edu.internet2.middleware.shibboleth.sp.provider.ODBCReplayCacheProvider"
- // These next two APIs are used to obtain the module-specific "OK"
- // and "Decline" results. OK means "we believe that this request
- // should be accepted". Declined means "we believe that this is
- // not a shibbolized request so we have no comment".
- virtual void* returnDecline(void);
- virtual void* returnOK(void);
-
- //
- // Note: Subclasses need not implement anything below this line
- //
-
- // These functions implement the server-agnostic shibboleth engine
- // The web server modules implement a subclass and then call into
- // these methods once they instantiate their request object.
- //
- // Return value:
- // these APIs will always return the result of sendPage(), sendRedirect(),
- // returnDecline(), or returnOK() in the void* portion of the return code.
- // Exactly what those values are is module- (subclass-) implementation
- // specific. The 'bool' part of the return value declares whether the
- // void* is valid or not. If the bool is true then the void* is valid.
- // If the bool is false then the API did not call any callback, the void*
- // is not valid, and the caller should continue processing (the API Call
- // finished successfully).
- //
- std::pair<bool,void*> doCheckAuthN(void);
- std::pair<bool,void*> doHandlePOST(void);
- std::pair<bool,void*> doCheckAuthZ(void);
- std::pair<bool,void*> doExportAssertions(bool exportAssertion);
-
- //**************************************************************************
- // These APIs are for backwards-compatibility. Hopefully they can
- // eventually go away.
-
- // SHIRE APIs
-
- // Get the session cookie name and properties for the application
- std::pair<const char*,const char*> getCookieNameProps() const;
-
- // Find the default assertion consumer service for the resource
- const char* getShireURL(const char* resource) const;
-
- // Generate a Shib 1.x AuthnRequest redirect URL for the resource
- const char* getAuthnRequest(const char* resource) const;
-
- // Process a lazy session setup request and turn it into an AuthnRequest
- const char* getLazyAuthnRequest(const char* query_string) const;
-
- // Process a POST profile submission, and return (SAMLResponse,TARGET) pair.
- std::pair<const char*,const char*>
- getFormSubmission(const char* post, unsigned int len) const;
-
- RPCError* sessionCreate(
- const char* response,
- const char* ip,
- std::string &cookie
- ) const;
- RPCError* sessionIsValid(const char* session_id, const char* ip) const;
-
- // RM APIS
-
- RPCError* getAssertions(
- const char* cookie,
- const char* ip,
- std::vector<saml::SAMLAssertion*>& assertions,
- saml::SAMLAuthenticationStatement **statement = NULL
- ) const;
- static void serialize(saml::SAMLAssertion &assertion, std::string &result);
-
-
- protected:
- ShibTarget(void);
-
- // Initialize the request from the parsed URL
- // protocol == http, https, etc
- // hostname == server name
- // port == server port
- // uri == resource path
- // method == GET, POST, etc.
- void init(ShibTargetConfig *config,
- std::string protocol, std::string hostname, int port,
- std::string uri, std::string content_type, std::string remote_host,
- std::string method, int total_bytes);
-
- private:
- mutable ShibTargetPriv *m_priv;
- };
-
- //******************************************************************************
- // You probably don't care about much below this line
- // unless you are using the lower-layer APIs provided by
- // the shib target library.
-
- class SHIBTARGET_EXPORTS SHIRE
+ class SHIBTARGET_EXPORTS ShibTargetConfig
{
public:
- SHIRE(const IApplication* app) { m_st = new ShibTarget(app); }
- ~SHIRE() { delete m_st; }
-
- // Get the session cookie name and properties for the application
- std::pair<const char*,const char*> getCookieNameProps() const
- { return m_st->getCookieNameProps(); }
-
- // Find the default assertion consumer service for the resource
- const char* getShireURL(const char* resource) const
- { return m_st->getShireURL(resource); }
-
- // Generate a Shib 1.x AuthnRequest redirect URL for the resource
- const char* getAuthnRequest(const char* resource) const
- { return m_st->getAuthnRequest(resource); }
-
- // Process a lazy session setup request and turn it into an AuthnRequest
- const char* getLazyAuthnRequest(const char* query_string) const
- { return m_st->getLazyAuthnRequest(query_string); }
-
- // Process a POST profile submission, and return (SAMLResponse,TARGET) pair.
- std::pair<const char*,const char*> getFormSubmission(const char* post, unsigned int len) const
- { return m_st->getFormSubmission(post, len); }
+ ShibTargetConfig() {}
+ virtual ~ShibTargetConfig() {}
- RPCError* sessionCreate(const char* response, const char* ip, std::string &cookie) const
- { return m_st->sessionCreate(response, ip, cookie); }
- RPCError* sessionIsValid(const char* session_id, const char* ip) const
- { return m_st->sessionIsValid(session_id, ip); }
-
- private:
- ShibTarget *m_st;
- //const IApplication* m_app;
- //mutable std::string m_cookieName;
- //mutable std::string m_shireURL;
- //mutable std::string m_authnRequest;
- //mutable CgiParse* m_parser;
+ virtual bool init(const char* schemadir) = 0;
+ virtual bool load(const char* config) = 0;
+ virtual void shutdown() = 0;
+
+ static ShibTargetConfig& getConfig();
};
}