First set of logout base classes and non-building draft of SP-initiated logout.

[shibboleth/sp.git] / shibsp / handler / impl / SAML1Consumer.cpp

diff --git a/shibsp/handler/impl/SAML1Consumer.cpp b/shibsp/handler/impl/SAML1Consumer.cpp
index 2efa16c..5d66396 100644 (file)
--- a/shibsp/handler/impl/SAML1Consumer.cpp
+++ b/shibsp/handler/impl/SAML1Consumer.cpp
@@ -21,32 +21,36 @@
  */
 
 #include "internal.h"
-#include "Application.h"
-#include "exceptions.h"
-#include "ServiceProvider.h"
-#include "SessionCache.h"
-#include "attribute/Attribute.h"
-#include "attribute/filtering/AttributeFilter.h"
-#include "attribute/filtering/BasicFilteringContext.h"
-#include "attribute/resolver/AttributeExtractor.h"
-#include "attribute/resolver/ResolutionContext.h"
 #include "handler/AssertionConsumerService.h"
 
-#include <saml/saml1/core/Assertions.h>
-#include <saml/saml1/core/Protocols.h>
-#include <saml/saml1/profile/BrowserSSOProfileValidator.h>
-#include <saml/saml2/metadata/Metadata.h>
-
-using namespace shibsp;
+#ifndef SHIBSP_LITE
+# include "exceptions.h"
+# include "Application.h"
+# include "ServiceProvider.h"
+# include "SessionCache.h"
+# include "attribute/Attribute.h"
+# include "attribute/filtering/AttributeFilter.h"
+# include "attribute/filtering/BasicFilteringContext.h"
+# include "attribute/resolver/AttributeExtractor.h"
+# include "attribute/resolver/ResolutionContext.h"
+# include <saml/saml1/core/Assertions.h>
+# include <saml/saml1/core/Protocols.h>
+# include <saml/saml1/profile/BrowserSSOProfileValidator.h>
+# include <saml/saml2/metadata/Metadata.h>
 using namespace opensaml::saml1;
 using namespace opensaml::saml1p;
 using namespace opensaml;
-using namespace xmltooling;
-using namespace log4cpp;
-using namespace std;
 using saml2::NameID;
 using saml2::NameIDBuilder;
 using saml2md::EntityDescriptor;
+#else
+# include "lite/SAMLConstants.h"
+#endif
+
+using namespace shibsp;
+using namespace xmltooling;
+using namespace log4cpp;
+using namespace std;
 
 namespace shibsp {
 
@@ -59,12 +63,15 @@ namespace shibsp {
     {
     public:
         SAML1Consumer(const DOMElement* e, const char* appId)
-                : AssertionConsumerService(e, appId, Category::getInstance(SHIBSP_LOGCAT".SAML1")) {
+                : AssertionConsumerService(e, appId, Category::getInstance(SHIBSP_LOGCAT".SAML1SSO")) {
+#ifndef SHIBSP_LITE
             m_post = XMLString::equals(getString("Binding").second, samlconstants::SAML1_PROFILE_BROWSER_POST);
+#endif
         }
         virtual ~SAML1Consumer() {}
         
     private:
+#ifndef SHIBSP_LITE
         string implementProtocol(
             const Application& application,
             const HTTPRequest& httpRequest,
@@ -72,8 +79,8 @@ namespace shibsp {
             const PropertySet* settings,
             const XMLObject& xmlObject
             ) const;
-
         bool m_post;
+#endif
     };
 
 #if defined (_MSC_VER)
@@ -87,6 +94,8 @@ namespace shibsp {
     
 };
 
+#ifndef SHIBSP_LITE
+
 string SAML1Consumer::implementProtocol(
     const Application& application,
     const HTTPRequest& httpRequest,
@@ -188,6 +197,14 @@ string SAML1Consumer::implementProtocol(
 
     NameIdentifier* n = ssoStatement->getSubject()->getNameIdentifier();
 
+    // Now we have to extract the authentication details for attribute and session setup.
+
+    // Session expiration for SAML 1.x is purely SP-driven, and the method is mapped to a ctx class.
+    const PropertySet* sessionProps = application.getPropertySet("Sessions");
+    pair<bool,unsigned int> lifetime = sessionProps ? sessionProps->getUnsignedInt("lifetime") : pair<bool,unsigned int>(true,28800);
+    if (!lifetime.first || lifetime.second == 0)
+        lifetime.second = 28800;
+
     // We've successfully "accepted" at least one SSO token, along with any additional valid tokens.
     // To complete processing, we need to extract and resolve attributes and then create the session.
     multimap<string,Attribute*> resolvedAttributes;
@@ -214,7 +231,7 @@ string SAML1Consumer::implementProtocol(
 
         AttributeFilter* filter = application.getAttributeFilter();
         if (filter && !resolvedAttributes.empty()) {
-            BasicFilteringContext fc(application, policy.getIssuerMetadata());
+            BasicFilteringContext fc(application, resolvedAttributes, policy.getIssuerMetadata(), ssoStatement->getAuthenticationMethod());
             Locker filtlocker(filter);
             try {
                 filter->filterAttributes(fc, resolvedAttributes);
@@ -228,7 +245,7 @@ string SAML1Consumer::implementProtocol(
         }
     }
 
-    // First, normalize the SAML 1.x NameIdentifier...
+    // Normalize the SAML 1.x NameIdentifier...
     auto_ptr<NameID> nameid(n ? NameIDBuilder::buildNameID() : NULL);
     if (n) {
         nameid->setName(n->getName());
@@ -236,22 +253,20 @@ string SAML1Consumer::implementProtocol(
         nameid->setNameQualifier(n->getNameQualifier());
     }
 
-    // Now we have to extract the authentication details for session setup.
-
-    // Session expiration for SAML 1.x is purely SP-driven, and the method is mapped to a ctx class.
-    const PropertySet* sessionProps = application.getPropertySet("Sessions");
-    pair<bool,unsigned int> lifetime = sessionProps ? sessionProps->getUnsignedInt("lifetime") : make_pair(true,28800);
-    if (!lifetime.first)
-        lifetime.second = 28800;
-    auto_ptr_char authnInstant(
-        ssoStatement->getAuthenticationInstant() ? ssoStatement->getAuthenticationInstant()->getRawData() : NULL
-        );
-    auto_ptr_char authnMethod(ssoStatement->getAuthenticationMethod());
-
     const EntityDescriptor* issuerMetadata =
         policy.getIssuerMetadata() ? dynamic_cast<const EntityDescriptor*>(policy.getIssuerMetadata()->getParent()) : NULL;
     auto_ptr<ResolutionContext> ctx(
-        resolveAttributes(application, issuerMetadata, nameid.get(), authnMethod.get(), NULL, &tokens, &resolvedAttributes)
+        resolveAttributes(
+            application,
+            issuerMetadata,
+            (!response->getMinorVersion().first || response->getMinorVersion().second==1) ?
+                samlconstants::SAML11_PROTOCOL_ENUM : samlconstants::SAML10_PROTOCOL_ENUM,
+            nameid.get(),
+            ssoStatement->getAuthenticationMethod(),
+            NULL,
+            &tokens,
+            &resolvedAttributes
+            )
         );
 
     if (ctx.get()) {
@@ -268,19 +283,21 @@ string SAML1Consumer::implementProtocol(
 
     try {
         string key = application.getServiceProvider().getSessionCache()->insert(
-            lifetime.second ? now + lifetime.second : 0,
+            now + lifetime.second,
             application,
             httpRequest.getRemoteAddr().c_str(),
             issuerMetadata,
+            (!response->getMinorVersion().first || response->getMinorVersion().second==1) ?
+                samlconstants::SAML11_PROTOCOL_ENUM : samlconstants::SAML10_PROTOCOL_ENUM,
             nameid.get(),
-            authnInstant.get(),
+            ssoStatement->getAuthenticationInstant() ? ssoStatement->getAuthenticationInstant()->getRawData() : NULL,
             NULL,
-            authnMethod.get(),
+            ssoStatement->getAuthenticationMethod(),
             NULL,
             &tokens,
             &resolvedAttributes
             );
-        resolvedAttributes.clear();  // Attributes are owned by cache now.
+        for_each(resolvedAttributes.begin(), resolvedAttributes.end(), cleanup_pair<string,Attribute>());
         return key;
     }
     catch (exception&) {
@@ -288,3 +305,5 @@ string SAML1Consumer::implementProtocol(
         throw;
     }
 }
+
+#endif