https://bugs.internet2.edu/jira/browse/SSPCPP-320

[shibboleth/sp.git] / shibsp / ServiceProvider.cpp

diff --git a/shibsp/ServiceProvider.cpp b/shibsp/ServiceProvider.cpp
index e166771..b358948 100644 (file)
--- a/shibsp/ServiceProvider.cpp
+++ b/shibsp/ServiceProvider.cpp
@@ -63,7 +63,7 @@ namespace shibsp {
 
         // Strictly for error handling, detect a nullptr application and point at the default.
         if (!app)
-            app = request.getServiceProvider().getApplication("default");
+            app = request.getServiceProvider().getApplication(nullptr);
 
         const PropertySet* props=app->getPropertySet("Errors");
 
@@ -144,6 +144,7 @@ namespace shibsp {
     void SHIBSP_DLLLOCAL clearHeaders(SPRequest& request) {
         const Application& app = request.getApplication();
         app.clearHeader(request, "Shib-Session-ID", "HTTP_SHIB_SESSION_ID");
+        app.clearHeader(request, "Shib-Session-Index", "HTTP_SHIB_SESSION_INDEX");
         app.clearHeader(request, "Shib-Identity-Provider", "HTTP_SHIB_IDENTITY_PROVIDER");
         app.clearHeader(request, "Shib-Authentication-Method", "HTTP_SHIB_AUTHENTICATION_METHOD");
         app.clearHeader(request, "Shib-Authentication-Instant", "HTTP_SHIB_AUTHENTICATION_INSTANT");
@@ -162,12 +163,53 @@ void SHIBSP_API shibsp::registerServiceProviders()
 
 ServiceProvider::ServiceProvider()
 {
+    m_authTypes.insert("shibboleth");
 }
 
 ServiceProvider::~ServiceProvider()
 {
 }
 
+#ifndef SHIBSP_LITE
+SecurityPolicyProvider* ServiceProvider::getSecurityPolicyProvider(bool required) const
+{
+    if (required)
+        throw ConfigurationException("No SecurityPolicyProvider available.");
+    return nullptr;
+}
+#endif
+
+Remoted* ServiceProvider::regListener(const char* address, Remoted* listener)
+{
+    Remoted* ret=nullptr;
+    map<string,Remoted*>::const_iterator i=m_listenerMap.find(address);
+    if (i!=m_listenerMap.end())
+        ret=i->second;
+    m_listenerMap[address]=listener;
+    Category::getInstance(SHIBSP_LOGCAT".ServiceProvider").info("registered remoted message endpoint (%s)",address);
+    return ret;
+}
+
+bool ServiceProvider::unregListener(const char* address, Remoted* current, Remoted* restore)
+{
+    map<string,Remoted*>::const_iterator i=m_listenerMap.find(address);
+    if (i!=m_listenerMap.end() && i->second==current) {
+        if (restore)
+            m_listenerMap[address]=restore;
+        else
+            m_listenerMap.erase(address);
+        Category::getInstance(SHIBSP_LOGCAT".ServiceProvider").info("unregistered remoted message endpoint (%s)",address);
+        return true;
+    }
+    return false;
+}
+
+Remoted* ServiceProvider::lookupListener(const char *address) const
+{
+    map<string,Remoted*>::const_iterator i=m_listenerMap.find(address);
+    return (i==m_listenerMap.end()) ? nullptr : i->second;
+}
+
 pair<bool,long> ServiceProvider::doAuthentication(SPRequest& request, bool handler) const
 {
 #ifdef _DEBUG
@@ -225,16 +267,18 @@ pair<bool,long> ServiceProvider::doAuthentication(SPRequest& request, bool handl
         pair<bool,bool> requireSession = settings.first->getBool("requireSession");
         pair<bool,const char*> requireSessionWith = settings.first->getString("requireSessionWith");
 
-        // If no session is required AND the AuthType (an Apache-derived concept) isn't shibboleth,
+        string lcAuthType;
+        if (authType.first) {
+            while (*authType.second)
+                lcAuthType += tolower(*authType.second++);
+        }
+
+        // If no session is required AND the AuthType (an Apache-derived concept) isn't recognized,
         // then we ignore this request and consider it unprotected. Apache might lie to us if
         // ShibBasicHijack is on, but that's up to it.
         if ((!requireSession.first || !requireSession.second) && !requireSessionWith.first &&
-#ifdef HAVE_STRCASECMP
-                (!authType.first || strcasecmp(authType.second,"shibboleth")))
-#else
-                (!authType.first || _stricmp(authType.second,"shibboleth")))
-#endif
-            return make_pair(true,request.returnDecline());
+                (!authType.first || m_authTypes.find(lcAuthType) == m_authTypes.end()))
+            return make_pair(true, request.returnDecline());
 
         // Fix for secadv 20050901
         clearHeaders(request);
@@ -274,7 +318,7 @@ pair<bool,long> ServiceProvider::doAuthentication(SPRequest& request, bool handl
             return initiator->run(request,false);
         }
 
-        request.setAuthType("shibboleth");
+        request.setAuthType(lcAuthType.c_str());
 
         // We're done.  Everything is okay.  Nothing to report.  Nothing to do..
         // Let the caller decide how to proceed.
@@ -308,16 +352,18 @@ pair<bool,long> ServiceProvider::doAuthorization(SPRequest& request) const
         pair<bool,bool> requireSession = settings.first->getBool("requireSession");
         pair<bool,const char*> requireSessionWith = settings.first->getString("requireSessionWith");
 
-        // If no session is required AND the AuthType (an Apache-derived concept) isn't shibboleth,
+        string lcAuthType;
+        if (authType.first) {
+            while (*authType.second)
+                lcAuthType += tolower(*authType.second++);
+        }
+
+        // If no session is required AND the AuthType (an Apache-derived concept) isn't recognized,
         // then we ignore this request and consider it unprotected. Apache might lie to us if
         // ShibBasicHijack is on, but that's up to it.
         if ((!requireSession.first || !requireSession.second) && !requireSessionWith.first &&
-#ifdef HAVE_STRCASECMP
-                (!authType.first || strcasecmp(authType.second,"shibboleth")))
-#else
-                (!authType.first || _stricmp(authType.second,"shibboleth")))
-#endif
-            return make_pair(true,request.returnDecline());
+                (!authType.first || m_authTypes.find(lcAuthType) == m_authTypes.end()))
+            return make_pair(true, request.returnDecline());
 
         // Do we have an access control plugin?
         if (settings.second) {
@@ -411,6 +457,9 @@ pair<bool,long> ServiceProvider::doExport(SPRequest& request, bool requireSessio
         hval = session->getAuthnContextDeclRef();
         if (hval)
             app->setHeader(request, "Shib-AuthnContext-Decl", hval);
+        hval = session->getSessionIndex();
+        if (hval)
+            app->setHeader(request, "Shib-Session-Index", hval);
 
         // Maybe export the assertion keys.
         pair<bool,bool> exp=settings.first->getBool("exportAssertion");