#include "ServiceProvider.h"
#include "SessionCache.h"
#include "SPConfig.h"
-#include "SPRequest.h"
#include "handler/SessionInitiator.h"
#include "remoting/ListenerService.h"
#include "util/DOMPropertySet.h"
#include "util/SPConstants.h"
-#include <log4cpp/Category.hh>
-#include <log4cpp/PropertyConfigurator.hh>
+#if defined(XMLTOOLING_LOG4SHIB)
+# include <log4shib/PropertyConfigurator.hh>
+#elif defined(XMLTOOLING_LOG4CPP)
+# include <log4cpp/PropertyConfigurator.hh>
+#else
+# error "Supported logging library not available."
+#endif
#include <xercesc/util/XMLUniDefs.hpp>
#include <xmltooling/XMLToolingConfig.h>
#include <xmltooling/util/NDC.h>
using namespace shibsp;
using namespace xmltooling;
-using namespace log4cpp;
using namespace std;
namespace {
XMLApplication(const ServiceProvider*, const DOMElement* e, const XMLApplication* base=NULL);
~XMLApplication() { cleanup(); }
- // Application
- const ServiceProvider& getServiceProvider() const {return *m_sp;}
- const char* getId() const {return getString("id").second;}
const char* getHash() const {return m_hash.c_str();}
#ifndef SHIBSP_LITE
return (m_audiences.empty() && m_base) ? m_base->getAudiences() : m_audiences;
}
#endif
- string getNotificationURL(const HTTPRequest& request, bool front, unsigned int index) const;
+ string getNotificationURL(const char* resource, bool front, unsigned int index) const;
const set<string>& getRemoteUserAttributeIds() const {
return (m_remoteUsers.empty() && m_base) ? m_base->getRemoteUserAttributeIds() : m_remoteUsers;
}
- void clearAttributeHeaders(SPRequest& request) const;
const SessionInitiator* getDefaultSessionInitiator() const;
const SessionInitiator* getSessionInitiatorById(const char* id) const;
const Handler* getDefaultAssertionConsumerService() const;
private:
void cleanup();
- const ServiceProvider* m_sp; // this is ok because its locking scope includes us
const XMLApplication* m_base;
string m_hash;
#ifndef SHIBSP_LITE
map<const XMLCh*,PropertySet*> m_partyMap;
#endif
#endif
+ std::set<std::string> m_remoteUsers;
vector<string> m_frontLogout,m_backLogout;
- set<string> m_remoteUsers;
- mutable vector< pair<string,string> > m_unsetHeaders;
- RWLock* m_unsetLock;
// manage handler objects
vector<Handler*> m_handlers;
map<string,Application*> m_appmap;
#ifndef SHIBSP_LITE
map< string,pair< PropertySet*,vector<const SecurityPolicyRule*> > > m_policyMap;
+ map< string, vector< pair< string, pair<string,string> > > > m_transportOptionMap;
#endif
// Provides filter to exclude special config elements.
}
// PropertySet
+ const PropertySet* getParent() const { return m_impl->getParent(); }
void setParent(const PropertySet* parent) {return m_impl->setParent(parent);}
pair<bool,bool> getBool(const char* name, const char* ns=NULL) const {return m_impl->getBool(name,ns);}
pair<bool,const char*> getString(const char* name, const char* ns=NULL) const {return m_impl->getString(name,ns);}
return i->second.second;
throw ConfigurationException("Security Policy ($1) not found, check <SecurityPolicies> element.", params(1,id));
}
+
+ bool setTransportOptions(const char* id, SOAPTransport& transport) const {
+ bool ret = true;
+ map< string, vector< pair< string, pair<string,string> > > >::const_iterator p =
+ m_impl->m_transportOptionMap.find(id);
+ if (p == m_impl->m_transportOptionMap.end())
+ return ret;
+ vector< pair< string, pair<string,string> > >::const_iterator opt;
+ for (opt = p->second.begin(); opt != p->second.end(); ++opt) {
+ if (!transport.setProviderOption(opt->first.c_str(), opt->second.first.c_str(), opt->second.second.c_str())) {
+ m_log.error("failed to set SOAPTransport option (%s)", opt->second.first.c_str());
+ ret = false;
+ }
+ }
+ return ret;
+ }
#endif
protected:
static const XMLCh MemoryListener[] = UNICODE_LITERAL_14(M,e,m,o,r,y,L,i,s,t,e,n,e,r);
static const XMLCh _MetadataProvider[] = UNICODE_LITERAL_16(M,e,t,a,d,a,t,a,P,r,o,v,i,d,e,r);
static const XMLCh Notify[] = UNICODE_LITERAL_6(N,o,t,i,f,y);
+ static const XMLCh _option[] = UNICODE_LITERAL_6(o,p,t,i,o,n);
static const XMLCh OutOfProcess[] = UNICODE_LITERAL_12(O,u,t,O,f,P,r,o,c,e,s,s);
static const XMLCh _path[] = UNICODE_LITERAL_4(p,a,t,h);
static const XMLCh Policy[] = UNICODE_LITERAL_6(P,o,l,i,c,y);
+ static const XMLCh _provider[] = UNICODE_LITERAL_8(p,r,o,v,i,d,e,r);
static const XMLCh RelyingParty[] = UNICODE_LITERAL_12(R,e,l,y,i,n,g,P,a,r,t,y);
static const XMLCh _ReplayCache[] = UNICODE_LITERAL_11(R,e,p,l,a,y,C,a,c,h,e);
static const XMLCh _RequestMapper[] = UNICODE_LITERAL_13(R,e,q,u,e,s,t,M,a,p,p,e,r);
static const XMLCh _SingleLogoutService[] = UNICODE_LITERAL_19(S,i,n,g,l,e,L,o,g,o,u,t,S,e,r,v,i,c,e);
static const XMLCh _StorageService[] = UNICODE_LITERAL_14(S,t,o,r,a,g,e,S,e,r,v,i,c,e);
static const XMLCh TCPListener[] = UNICODE_LITERAL_11(T,C,P,L,i,s,t,e,n,e,r);
+ static const XMLCh TransportOption[] = UNICODE_LITERAL_15(T,r,a,n,s,p,o,r,t,O,p,t,i,o,n);
static const XMLCh _TrustEngine[] = UNICODE_LITERAL_11(T,r,u,s,t,E,n,g,i,n,e);
static const XMLCh _type[] = UNICODE_LITERAL_4(t,y,p,e);
static const XMLCh UnixListener[] = UNICODE_LITERAL_12(U,n,i,x,L,i,s,t,e,n,e,r);
-
+#ifndef SHIBSP_LITE
class SHIBSP_DLLLOCAL PolicyNodeFilter : public DOMNodeFilter
{
public:
short acceptNode(const DOMNode* node) const {
- if (XMLHelper::isNodeNamed(node,shibspconstants::SHIB2SPCONFIG_NS,Rule))
- return FILTER_REJECT;
- return FILTER_ACCEPT;
+ return FILTER_REJECT;
}
};
+#endif
};
namespace shibsp {
const ServiceProvider* sp,
const DOMElement* e,
const XMLApplication* base
- ) : m_sp(sp), m_base(base),
+ ) : Application(sp), m_base(base),
#ifndef SHIBSP_LITE
m_metadata(NULL), m_trust(NULL),
m_attrExtractor(NULL), m_attrFilter(NULL), m_attrResolver(NULL),
m_credResolver(NULL), m_partyDefault(NULL),
#endif
- m_unsetLock(NULL), m_acsDefault(NULL), m_sessionInitDefault(NULL), m_artifactResolutionDefault(NULL)
+ m_acsDefault(NULL), m_sessionInitDefault(NULL), m_artifactResolutionDefault(NULL)
{
#ifdef _DEBUG
xmltooling::NDC ndc("XMLApplication");
attributes = getString("unsetHeaders");
if (attributes.first) {
+ string transformedprefix("HTTP_");
+ const char* pch;
+ pair<bool,const char*> prefix = getString("metadataAttributePrefix");
+ if (prefix.first) {
+ pch = prefix.second;
+ while (*pch) {
+ transformedprefix += (isalnum(*pch) ? toupper(*pch) : '_');
+ pch++;
+ }
+ }
char* dup = strdup(attributes.second);
char* pos;
char* start = dup;
if (pos)
*pos=0;
- string transformed("HTTP_");
- const char* pch = start;
+ string transformed;
+ pch = start;
while (*pch) {
transformed += (isalnum(*pch) ? toupper(*pch) : '_');
pch++;
}
- m_unsetHeaders.push_back(pair<string,string>(start,transformed));
+ m_unsetHeaders.push_back(pair<string,string>(start,string("HTTP_") + transformed));
+ if (prefix.first)
+ m_unsetHeaders.push_back(pair<string,string>(string(prefix.second) + start, transformedprefix + transformed));
start = pos ? pos+1 : NULL;
}
free(dup);
handler = conf.HandlerManager.newPlugin(samlconstants::SAML20_BINDING_URI, make_pair(sessions->getElement(), getId()));
m_handlers.push_back(handler);
- // Insert into location map.
+ // Insert into location map. If it contains the handlerURL, we skip past that part.
+ const char* pch = strstr(location.second, sessions->getString("handlerURL").second);
+ if (pch)
+ location.second = pch + strlen(sessions->getString("handlerURL").second);
if (*location.second == '/')
m_handlerMap[location.second]=handler;
else
m_unsetHeaders.push_back(pair<string,string>("Shib-Application-ID","HTTP_SHIB_APPLICATION_ID"));
}
else {
+ string transformedprefix("HTTP_");
+ const char* pch;
+ pair<bool,const char*> prefix = getString("metadataAttributePrefix");
+ if (prefix.first) {
+ pch = prefix.second;
+ while (*pch) {
+ transformedprefix += (isalnum(*pch) ? toupper(*pch) : '_');
+ pch++;
+ }
+ }
for (vector<string>::const_iterator hdr = unsetHeaders.begin(); hdr!=unsetHeaders.end(); ++hdr) {
- string transformed("HTTP_");
- const char* pch = hdr->c_str();
+ string transformed;
+ pch = hdr->c_str();
while (*pch) {
transformed += (isalnum(*pch) ? toupper(*pch) : '_');
pch++;
}
- m_unsetHeaders.push_back(pair<string,string>(*hdr,transformed));
+ m_unsetHeaders.push_back(pair<string,string>(*hdr, string("HTTP_") + transformed));
+ if (prefix.first)
+ m_unsetHeaders.push_back(pair<string,string>(string(prefix.second) + *hdr, transformedprefix + transformed));
}
m_unsetHeaders.push_back(pair<string,string>("Shib-Application-ID","HTTP_SHIB_APPLICATION_ID"));
}
}
#endif
- // In process only, we need a shared lock around accessing the header clearing list.
- if (!conf.isEnabled(SPConfig::OutOfProcess)) {
- m_unsetLock = RWLock::create();
- }
- else if (!conf.isEnabled(SPConfig::InProcess)) {
+ // Out of process only, we register a listener endpoint.
+ if (!conf.isEnabled(SPConfig::InProcess)) {
ListenerService* listener = sp->getListenerService(false);
if (listener) {
string addr=string(getId()) + "::getHeaders::Application";
string addr=string(getId()) + "::getHeaders::Application";
listener->unregListener(addr.c_str(),this);
}
- delete m_unsetLock;
- m_unsetLock = NULL;
for_each(m_handlers.begin(),m_handlers.end(),xmltooling::cleanup<Handler>());
m_handlers.clear();
#ifndef SHIBSP_LITE
#else
map<const XMLCh*,PropertySet*>::const_iterator i=m_partyMap.begin();
for (; i!=m_partyMap.end(); i++) {
- if (XMLString::equals(i->first,provider->getId()))
+ if (XMLString::equals(i->first,provider->getEntityID()))
return i->second;
const EntitiesDescriptor* group=dynamic_cast<const EntitiesDescriptor*>(provider->getParent());
while (group) {
#endif
-string XMLApplication::getNotificationURL(const HTTPRequest& request, bool front, unsigned int index) const
+string XMLApplication::getNotificationURL(const char* resource, bool front, unsigned int index) const
{
const vector<string>& locs = front ? m_frontLogout : m_backLogout;
if (locs.empty())
- return m_base ? m_base->getNotificationURL(request, front, index) : string();
+ return m_base ? m_base->getNotificationURL(resource, front, index) : string();
else if (index >= locs.size())
return string();
- const char* resource = request.getRequestURL();
#ifdef HAVE_STRCASECMP
if (!resource || (strncasecmp(resource,"http://",7) && strncasecmp(resource,"https://",8)))
#else
return m_base ? m_base->getHandler(path) : NULL;
}
-void XMLApplication::clearAttributeHeaders(SPRequest& request) const
-{
- if (SPConfig::getConfig().isEnabled(SPConfig::OutOfProcess)) {
- for (vector< pair<string,string> >::const_iterator i = m_unsetHeaders.begin(); i!=m_unsetHeaders.end(); ++i)
- request.clearHeader(i->first.c_str(), i->second.c_str());
- return;
- }
-
- m_unsetLock->rdlock();
- if (m_unsetHeaders.empty()) {
- // No headers yet, so we have to request them from the remote half.
- m_unsetLock->unlock();
- m_unsetLock->wrlock();
- if (m_unsetHeaders.empty()) {
- SharedLock wrlock(m_unsetLock, false);
- string addr=string(getId()) + "::getHeaders::Application";
- DDF out,in = DDF(addr.c_str());
- DDFJanitor jin(in),jout(out);
- out = getServiceProvider().getListenerService()->send(in);
- if (out.islist()) {
- DDF header = out.first();
- while (header.isstring()) {
- m_unsetHeaders.push_back(pair<string,string>(header.name(),header.string()));
- header = out.next();
- }
- }
- }
- else {
- m_unsetLock->unlock();
- }
- m_unsetLock->rdlock();
- }
-
- // Now holding read lock.
- SharedLock unsetLock(m_unsetLock, false);
- for (vector< pair<string,string> >::const_iterator i = m_unsetHeaders.begin(); i!=m_unsetHeaders.end(); ++i)
- request.clearHeader(i->first.c_str(), i->second.c_str());
-}
-
short XMLConfigImpl::acceptNode(const DOMNode* node) const
{
if (!XMLString::equals(node->getNamespaceURI(),shibspconstants::SHIB2SPCONFIG_NS))
auto_ptr<DOMPropertySet> settings(new DOMPropertySet());
settings->load(child, log, &filter);
rules.first = settings.release();
+
+ // Process Rule elements.
const DOMElement* rule = XMLHelper::getFirstChildElement(child,Rule);
while (rule) {
auto_ptr_char type(rule->getAttributeNS(NULL,_type));
}
rule = XMLHelper::getNextSiblingElement(rule,Rule);
}
+
+ // Process TransportOption elements.
+ rule = XMLHelper::getFirstChildElement(child,TransportOption);
+ while (rule) {
+ if (rule->hasChildNodes()) {
+ auto_ptr_char provider(rule->getAttributeNS(NULL,_provider));
+ auto_ptr_char option(rule->getAttributeNS(NULL,_option));
+ auto_ptr_char value(rule->getFirstChild()->getNodeValue());
+ if (provider.get() && *provider.get() && option.get() && *option.get() && value.get() && *value.get()) {
+ m_transportOptionMap[id.get()].push_back(
+ make_pair(provider.get(), make_pair(option.get(), value.get()))
+ );
+ }
+ }
+ rule = XMLHelper::getNextSiblingElement(rule,TransportOption);
+ }
+
child = XMLHelper::getNextSiblingElement(child,Policy);
}
}
projects / shibboleth / sp.git / blobdiff