First set of logout base classes and non-building draft of SP-initiated logout.

[shibboleth/sp.git] / shibsp / handler / impl / AssertionConsumerService.cpp

diff --git a/shibsp/handler/impl/AssertionConsumerService.cpp b/shibsp/handler/impl/AssertionConsumerService.cpp
index c5e9080..a936fac 100644 (file)
--- a/shibsp/handler/impl/AssertionConsumerService.cpp
+++ b/shibsp/handler/impl/AssertionConsumerService.cpp
@@ -24,17 +24,23 @@
 #include "Application.h"
 #include "exceptions.h"
 #include "ServiceProvider.h"
-#include "attribute/resolver/AttributeResolver.h"
-#include "attribute/resolver/ResolutionContext.h"
 #include "handler/AssertionConsumerService.h"
 #include "util/SPConstants.h"
 
-#include <saml/SAMLConfig.h>
-#include <saml/saml1/core/Assertions.h>
-#include <saml/util/CommonDomainCookie.h>
+# include <ctime>
+#ifndef SHIBSP_LITE
+# include "attribute/resolver/AttributeResolver.h"
+# include "attribute/resolver/ResolutionContext.h"
+# include "security/SecurityPolicy.h"
+# include <saml/SAMLConfig.h>
+# include <saml/saml1/core/Assertions.h>
+# include <saml/util/CommonDomainCookie.h>
+using namespace samlconstants;
+#else
+# include "lite/CommonDomainCookie.h"
+#endif
 
 using namespace shibspconstants;
-using namespace samlconstants;
 using namespace shibsp;
 using namespace opensaml;
 using namespace xmltooling;
@@ -42,22 +48,27 @@ using namespace log4cpp;
 using namespace std;
 
 AssertionConsumerService::AssertionConsumerService(const DOMElement* e, const char* appId, Category& log)
-    : AbstractHandler(e, log), m_decoder(NULL), m_configNS(SHIB2SPCONFIG_NS),
-        m_role(samlconstants::SAML20MD_NS, opensaml::saml2md::IDPSSODescriptor::LOCAL_NAME)
+    : AbstractHandler(e, log)
+#ifndef SHIBSP_LITE
+        ,m_decoder(NULL), m_role(samlconstants::SAML20MD_NS, opensaml::saml2md::IDPSSODescriptor::LOCAL_NAME)
+#endif
 {
     string address(appId);
     address += getString("Location").second;
-    address += "::run::ACS";
     setAddress(address.c_str());
+#ifndef SHIBSP_LITE
     if (SPConfig::getConfig().isEnabled(SPConfig::OutOfProcess)) {
         m_decoder = SAMLConfig::getConfig().MessageDecoderManager.newPlugin(getString("Binding").second,e);
         m_decoder->setArtifactResolver(SPConfig::getConfig().getArtifactResolver());
     }
+#endif
 }
 
 AssertionConsumerService::~AssertionConsumerService()
 {
+#ifndef SHIBSP_LITE
     delete m_decoder;
+#endif
 }
 
 pair<bool,long> AssertionConsumerService::run(SPRequest& request, bool isHandler) const
@@ -78,7 +89,6 @@ pair<bool,long> AssertionConsumerService::run(SPRequest& request, bool isHandler
             DDF out,in = wrap(request);
             DDFJanitor jin(in), jout(out);
             
-            in.addmember("application_id").string(request.getApplication().getId());
             try {
                 out=request.getServiceProvider().getListenerService()->send(in);
             }
@@ -87,7 +97,7 @@ pair<bool,long> AssertionConsumerService::run(SPRequest& request, bool isHandler
                 if (ex.getProperty("RelayState"))
                     relayState = ex.getProperty("RelayState");
                 try {
-                    recoverRelayState(request, relayState);
+                    recoverRelayState(request.getApplication(), request, relayState);
                 }
                 catch (exception& ex2) {
                     m_log.error("trapped an error during RelayState recovery while handling an error: %s", ex2.what());
@@ -98,7 +108,7 @@ pair<bool,long> AssertionConsumerService::run(SPRequest& request, bool isHandler
             // We invoke RelayState recovery one last time on this side of the boundary.
             if (out["RelayState"].isstring())
                 relayState = out["RelayState"].string(); 
-            recoverRelayState(request, relayState);
+            recoverRelayState(request.getApplication(), request, relayState);
     
             // If it worked, we have a session key.
             if (!out["key"].isstring())
@@ -157,6 +167,7 @@ string AssertionConsumerService::processMessage(
     const Application& application, HTTPRequest& httpRequest, string& entityID, string& relayState
     ) const
 {
+#ifndef SHIBSP_LITE
     // Locate policy key.
     pair<bool,const char*> policyId = getString("policyId", m_configNS.get());  // namespace-qualified if inside handler element
     if (!policyId.first)
@@ -170,19 +181,13 @@ string AssertionConsumerService::processMessage(
     Locker metadataLocker(application.getMetadataProvider());
 
     // Create the policy.
-    SecurityPolicy policy(
-        application.getServiceProvider().getPolicyRules(policyId.second), 
-        application.getMetadataProvider(),
-        &m_role,
-        application.getTrustEngine(),
-        validate.first && validate.second
-        );
+    shibsp::SecurityPolicy policy(application, &m_role, validate.first && validate.second);
     
     // Decode the message and process it in a protocol-specific way.
     auto_ptr<XMLObject> msg(m_decoder->decode(relayState, httpRequest, policy));
     if (!msg.get())
         throw BindingException("Failed to decode an SSO protocol response.");
-    recoverRelayState(httpRequest, relayState);
+    recoverRelayState(application, httpRequest, relayState);
     string key = implementProtocol(application, httpRequest, policy, settings, *msg.get());
 
     auto_ptr_char issuer(policy.getIssuer() ? policy.getIssuer()->getName() : NULL);
@@ -190,6 +195,9 @@ string AssertionConsumerService::processMessage(
         entityID = issuer.get();
     
     return key;
+#else
+    throw ConfigurationException("Cannot process message using lite version of shibsp library.");
+#endif
 }
 
 pair<bool,long> AssertionConsumerService::sendRedirect(
@@ -231,26 +239,32 @@ void AssertionConsumerService::checkAddress(
     }
 }
 
+#ifndef SHIBSP_LITE
 ResolutionContext* AssertionConsumerService::resolveAttributes(
     const Application& application,
-    const HTTPRequest& httpRequest,
     const saml2md::EntityDescriptor* issuer,
+    const XMLCh* protocol,
     const saml2::NameID* nameid,
-    const vector<const Assertion*>* tokens
+    const XMLCh* authncontext_class,
+    const XMLCh* authncontext_decl,
+    const vector<const Assertion*>* tokens,
+    const multimap<string,Attribute*>* attributes
     ) const
 {
-    AttributeResolver* resolver = application.getAttributeResolver();
-    if (!resolver) {
-        m_log.info("no AttributeResolver available, skipping resolution");
-        return NULL;
-    }
-    
     try {
+        AttributeResolver* resolver = application.getAttributeResolver();
+        if (!resolver) {
+            m_log.info("no AttributeResolver available, skipping resolution");
+            return NULL;
+        }
+        
         m_log.debug("resolving attributes...");
+
+        Locker locker(resolver);
         auto_ptr<ResolutionContext> ctx(
-            resolver->createResolutionContext(application, httpRequest.getRemoteAddr().c_str(), issuer, nameid, tokens)
+            resolver->createResolutionContext(application, issuer, protocol, nameid, authncontext_class, authncontext_decl, tokens, attributes)
             );
-        resolver->resolveAttributes(*ctx.get(), application.getAttributeIds());
+        resolver->resolveAttributes(*ctx.get());
         return ctx.release();
     }
     catch (exception& ex) {
@@ -259,6 +273,7 @@ ResolutionContext* AssertionConsumerService::resolveAttributes(
     
     return NULL;
 }
+#endif
 
 void AssertionConsumerService::maintainHistory(SPRequest& request, const char* entityID, const char* cookieProps) const
 {