X-Git-Url: http://www.project-moonshot.org/gitweb/?a=blobdiff_plain;f=adfs%2Fadfs.cpp;h=c74912f2eecf155d97a373d83aaa3ae1aeec0967;hb=eab3df9a887298b7e35940a7a69c155832589457;hp=3c0fdffeb6b658cbee03d4e5f477df5419ce2942;hpb=bd1247abd6efaa504e09d59103291d261f711f72;p=shibboleth%2Fcpp-sp.git diff --git a/adfs/adfs.cpp b/adfs/adfs.cpp index 3c0fdff..c74912f 100644 --- a/adfs/adfs.cpp +++ b/adfs/adfs.cpp @@ -1,23 +1,27 @@ -/* - * Copyright 2001-2005 Internet2 - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at +/** + * Licensed to the University Corporation for Advanced Internet + * Development, Inc. (UCAID) under one or more contributor license + * agreements. See the NOTICE file distributed with this work for + * additional information regarding copyright ownership. + * + * UCAID licenses this file to you under the Apache License, + * Version 2.0 (the "License"); you may not use this file except + * in compliance with the License. You may obtain a copy of the + * License at * - * http://www.apache.org/licenses/LICENSE-2.0 + * http://www.apache.org/licenses/LICENSE-2.0 * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, + * either express or implied. See the License for the specific + * language governing permissions and limitations under the License. */ /** * adfs.cpp * - * ADFSv1 extension library + * ADFSv1 extension library. */ #if defined (_MSC_VER) || defined(__BORLANDC__) @@ -40,32 +44,43 @@ #include #include #include +#include +#include #include -#include +#include #include #include +#include #include #include #include -#include +#include #ifndef SHIBSP_LITE # include +# include # include +# include +# include # include -# include # include # include # include +# include # include +# include # include using namespace opensaml::saml2md; +# ifndef min +# define min(a,b) (((a) < (b)) ? (a) : (b)) +# endif #endif using namespace shibsp; using namespace opensaml; using namespace xmltooling::logging; using namespace xmltooling; using namespace xercesc; +using namespace boost; using namespace std; #define WSFED_NS "http://schemas.xmlsoap.org/ws/2003/07/secext" @@ -80,7 +95,11 @@ namespace { public: ADFSDecoder() : m_ns(WSTRUST_NS) {} virtual ~ADFSDecoder() {} - + + const XMLCh* getProtocolFamily() const { + return m_ns.get(); + } + XMLObject* decode(string& relayState, const GenericRequest& genericRequest, SecurityPolicy& policy) const; protected: @@ -105,7 +124,7 @@ namespace { { public: ADFSSessionInitiator(const DOMElement* e, const char* appId) - : AbstractHandler(e, Category::getInstance(SHIBSP_LOGCAT".SessionInitiator.ADFS")), m_appId(appId), m_binding(WSFED_NS) { + : AbstractHandler(e, Category::getInstance(SHIBSP_LOGCAT ".SessionInitiator.ADFS"), nullptr, &m_remapper), m_appId(appId), m_binding(WSFED_NS) { // If Location isn't set, defer address registration until the setParent call. pair loc = getString("Location"); if (loc.first) { @@ -114,7 +133,7 @@ namespace { } } virtual ~ADFSSessionInitiator() {} - + void setParent(const PropertySet* parent) { DOMPropertySet::setParent(parent); pair loc = getString("Location"); @@ -128,14 +147,27 @@ namespace { } void receive(DDF& in, ostream& out); - pair run(SPRequest& request, const char* entityID=NULL, bool isHandler=true) const; + pair unwrap(SPRequest& request, DDF& out) const; + pair run(SPRequest& request, string& entityID, bool isHandler=true) const; + + const XMLCh* getProtocolFamily() const { + return m_binding.get(); + } + +#ifndef SHIBSP_LITE + void generateMetadata(saml2md::SPSSODescriptor& role, const char* handlerURL) const { + doGenerateMetadata(role, handlerURL); + } +#endif private: pair doRequest( const Application& application, + const HTTPRequest* httpRequest, HTTPResponse& httpResponse, const char* entityID, const char* acsLocation, + const char* authnContextClassRef, string& relayState ) const; string m_appId; @@ -144,13 +176,10 @@ namespace { class SHIBSP_DLLLOCAL ADFSConsumer : public shibsp::AssertionConsumerService { + auto_ptr_XMLCh m_protocol; public: ADFSConsumer(const DOMElement* e, const char* appId) - : shibsp::AssertionConsumerService(e, appId, Category::getInstance(SHIBSP_LOGCAT".SSO.ADFS")) -#ifndef SHIBSP_LITE - ,m_protocol(WSFED_NS) -#endif - {} + : shibsp::AssertionConsumerService(e, appId, Category::getInstance(SHIBSP_LOGCAT ".SSO.ADFS")), m_protocol(WSFED_NS) {} virtual ~ADFSConsumer() {} #ifndef SHIBSP_LITE @@ -159,24 +188,27 @@ namespace { role.addSupport(m_protocol.get()); } - auto_ptr_XMLCh m_protocol; - private: - string implementProtocol( + void implementProtocol( const Application& application, const HTTPRequest& httpRequest, + HTTPResponse& httpResponse, SecurityPolicy& policy, - const PropertySet* settings, + const PropertySet*, const XMLObject& xmlObject ) const; +#else + const XMLCh* getProtocolFamily() const { + return m_protocol.get(); + } #endif }; - class SHIBSP_DLLLOCAL ADFSLogoutInitiator : public AbstractHandler, public RemotedHandler + class SHIBSP_DLLLOCAL ADFSLogoutInitiator : public AbstractHandler, public LogoutInitiator { public: ADFSLogoutInitiator(const DOMElement* e, const char* appId) - : AbstractHandler(e, Category::getInstance(SHIBSP_LOGCAT".LogoutInitiator.ADFS")), m_appId(appId), m_binding(WSFED_NS) { + : AbstractHandler(e, Category::getInstance(SHIBSP_LOGCAT ".LogoutInitiator.ADFS")), m_appId(appId), m_binding(WSFED_NS) { // If Location isn't set, defer address registration until the setParent call. pair loc = getString("Location"); if (loc.first) { @@ -185,7 +217,7 @@ namespace { } } virtual ~ADFSLogoutInitiator() {} - + void setParent(const PropertySet* parent) { DOMPropertySet::setParent(parent); pair loc = getString("Location"); @@ -201,16 +233,12 @@ namespace { void receive(DDF& in, ostream& out); pair run(SPRequest& request, bool isHandler=true) const; -#ifndef SHIBSP_LITE - const char* getType() const { - return "LogoutInitiator"; + const XMLCh* getProtocolFamily() const { + return m_binding.get(); } -#endif private: - pair doRequest( - const Application& application, const char* requestURL, const char* entityID, HTTPResponse& httpResponse - ) const; + pair doRequest(const Application& application, const HTTPRequest& httpRequest, HTTPResponse& httpResponse, Session* session) const; string m_appId; auto_ptr_XMLCh m_binding; @@ -220,9 +248,9 @@ namespace { { public: ADFSLogout(const DOMElement* e, const char* appId) - : AbstractHandler(e, Category::getInstance(SHIBSP_LOGCAT".Logout.ADFS")), m_login(e, appId) { -#ifndef SHIBSP_LITE + : AbstractHandler(e, Category::getInstance(SHIBSP_LOGCAT ".Logout.ADFS")), m_login(e, appId) { m_initiator = false; +#ifndef SHIBSP_LITE m_preserve.push_back("wreply"); string address = string(appId) + getString("Location").second + "::run::ADFSLO"; setAddress(address.c_str()); @@ -243,7 +271,7 @@ namespace { auto_ptr_XMLCh widen(hurl.c_str()); SingleLogoutService* ep = SingleLogoutServiceBuilder::buildSingleLogoutService(); ep->setLocation(widen.get()); - ep->setBinding(m_login.m_protocol.get()); + ep->setBinding(m_login.getProtocolFamily()); role.getSingleLogoutServices().push_back(ep); } @@ -251,6 +279,9 @@ namespace { return m_login.getType(); } #endif + const XMLCh* getProtocolFamily() const { + return m_login.getProtocolFamily(); + } private: ADFSConsumer m_login; @@ -288,8 +319,8 @@ extern "C" int ADFS_EXPORTS xmltooling_extension_init(void*) conf.AssertionConsumerServiceManager.registerFactory(WSFED_NS, ADFSLogoutFactory); #ifndef SHIBSP_LITE SAMLConfig::getConfig().MessageDecoderManager.registerFactory(WSFED_NS, ADFSDecoderFactory); - XMLObjectBuilder::registerBuilder(QName(WSTRUST_NS,"RequestedSecurityToken"), new AnyElementBuilder()); - XMLObjectBuilder::registerBuilder(QName(WSTRUST_NS,"RequestSecurityTokenResponse"), new AnyElementBuilder()); + XMLObjectBuilder::registerBuilder(xmltooling::QName(WSTRUST_NS,"RequestedSecurityToken"), new AnyElementBuilder()); + XMLObjectBuilder::registerBuilder(xmltooling::QName(WSTRUST_NS,"RequestSecurityTokenResponse"), new AnyElementBuilder()); #endif return 0; } @@ -308,97 +339,119 @@ extern "C" void ADFS_EXPORTS xmltooling_extension_term() */ } -pair ADFSSessionInitiator::run(SPRequest& request, const char* entityID, bool isHandler) const +pair ADFSSessionInitiator::run(SPRequest& request, string& entityID, bool isHandler) const { // We have to know the IdP to function. - if (!entityID || !*entityID) - return make_pair(false,0); + if (entityID.empty() || !checkCompatibility(request, isHandler)) + return make_pair(false, 0L); string target; - const Handler* ACS=NULL; - const char* option; - const Application& app=request.getApplication(); + pair prop; + pair acClass; + const Handler* ACS = nullptr; + const Application& app = request.getApplication(); if (isHandler) { - option = request.getParameter("target"); - if (option) - target = option; + prop.second = request.getParameter("acsIndex"); + if (prop.second && *prop.second) { + ACS = app.getAssertionConsumerServiceByIndex(atoi(prop.second)); + if (!ACS) + request.log(SPRequest::SPWarn, "invalid acsIndex specified in request, using acsIndex property"); + } + + prop = getString("target", request); + if (prop.first) + target = prop.second; // Since we're passing the ACS by value, we need to compute the return URL, // so we'll need the target resource for real. - recoverRelayState(request.getApplication(), request, target, false); + recoverRelayState(app, request, request, target, false); + app.limitRedirect(request, target.c_str()); + + acClass = getString("authnContextClassRef", request); } else { - // We're running as a "virtual handler" from within the filter. - // The target resource is the current one and everything else is defaulted. - target=request.getRequestURL(); + // Check for a hardwired target value in the map or handler. + prop = getString("target", request, HANDLER_PROPERTY_MAP|HANDLER_PROPERTY_FIXED); + if (prop.first) + target = prop.second; + else + target = request.getRequestURL(); + + acClass = getString("authnContextClassRef", request, HANDLER_PROPERTY_MAP|HANDLER_PROPERTY_FIXED); } - // Since we're not passing by index, we need to fully compute the return URL. if (!ACS) { - // Get all the ADFS endpoints. - const vector& handlers = app.getAssertionConsumerServicesByBinding(m_binding.get()); - - // Index comes from request, or default set in the handler, or we just pick the first endpoint. - pair index = make_pair(false,0); - if (isHandler) { - option = request.getParameter("acsIndex"); - if (option) - index = make_pair(true, atoi(option)); - } - if (!index.first) - index = getUnsignedInt("defaultACSIndex"); - if (index.first) { - for (vector::const_iterator h = handlers.begin(); !ACS && h!=handlers.end(); ++h) { - if (index.second == (*h)->getUnsignedInt("index").second) - ACS = *h; - } - } - else if (!handlers.empty()) { - ACS = handlers.front(); - } + pair index = getUnsignedInt("acsIndex", request, HANDLER_PROPERTY_MAP|HANDLER_PROPERTY_FIXED); + if (index.first) + ACS = app.getAssertionConsumerServiceByIndex(index.second); + } + + // Validate the ACS for use with this protocol. + if (!ACS || !XMLString::equals(getProtocolFamily(), ACS->getProtocolFamily())) { + if (ACS) + request.log(SPRequest::SPWarn, "invalid acsIndex property, or non-ADFS ACS, using default ADFS ACS"); + ACS = app.getAssertionConsumerServiceByProtocol(getProtocolFamily()); + if (!ACS) + throw ConfigurationException("Unable to locate an ADFS-compatible ACS in the configuration."); } - if (!ACS) - throw ConfigurationException("Unable to locate ADFS response endpoint."); + // Since we're not passing by index, we need to fully compute the return URL. // Compute the ACS URL. We add the ACS location to the base handlerURL. - string ACSloc=request.getHandlerURL(target.c_str()); - pair loc=ACS ? ACS->getString("Location") : pair(false,NULL); - if (loc.first) ACSloc+=loc.second; + string ACSloc = request.getHandlerURL(target.c_str()); + prop = ACS->getString("Location"); + if (prop.first) + ACSloc += prop.second; if (isHandler) { // We may already have RelayState set if we looped back here, - // but just in case target is a resource, we reset it back. - target.erase(); - option = request.getParameter("target"); - if (option) - target = option; + // but we've turned it back into a resource by this point, so if there's + // a target on the URL, reset to that value. + prop.second = request.getParameter("target"); + if (prop.second && *prop.second) + target = prop.second; } - m_log.debug("attempting to initiate session using ADFS with provider (%s)", entityID); + m_log.debug("attempting to initiate session using ADFS with provider (%s)", entityID.c_str()); - if (SPConfig::getConfig().isEnabled(SPConfig::OutOfProcess)) - return doRequest(app, request, entityID, ACSloc.c_str(), target); + if (SPConfig::getConfig().isEnabled(SPConfig::OutOfProcess)) { + // Out of process means the POST data via the request can be exposed directly to the private method. + // The method will handle POST preservation if necessary *before* issuing the response, but only if + // it dispatches to an IdP. + return doRequest(app, &request, request, entityID.c_str(), ACSloc.c_str(), (acClass.first ? acClass.second : nullptr), target); + } // Remote the call. DDF out,in = DDF(m_address.c_str()).structure(); DDFJanitor jin(in), jout(out); in.addmember("application_id").string(app.getId()); - in.addmember("entity_id").string(entityID); + in.addmember("entity_id").string(entityID.c_str()); in.addmember("acsLocation").string(ACSloc.c_str()); if (!target.empty()) - in.addmember("RelayState").string(target.c_str()); + in.addmember("RelayState").unsafe_string(target.c_str()); + if (acClass.first) + in.addmember("authnContextClassRef").string(acClass.second); // Remote the processing. out = request.getServiceProvider().getListenerService()->send(in); return unwrap(request, out); } +pair ADFSSessionInitiator::unwrap(SPRequest& request, DDF& out) const +{ + // See if there's any response to send back. + if (!out["redirect"].isnull() || !out["response"].isnull()) { + // If so, we're responsible for handling the POST data, probably by dropping a cookie. + preservePostData(request.getApplication(), request, request, out["RelayState"].string()); + } + return RemotedHandler::unwrap(request, out); +} + void ADFSSessionInitiator::receive(DDF& in, ostream& out) { // Find application. - const char* aid=in["application_id"].string(); - const Application* app=aid ? SPConfig::getConfig().getServiceProvider()->getApplication(aid) : NULL; + const char* aid = in["application_id"].string(); + const Application* app = aid ? SPConfig::getConfig().getServiceProvider()->getApplication(aid) : nullptr; if (!app) { // Something's horribly wrong. m_log.error("couldn't find application (%s) to generate ADFS request", aid ? aid : "(missing)"); @@ -410,55 +463,72 @@ void ADFSSessionInitiator::receive(DDF& in, ostream& out) if (!entityID || !acsLocation) throw ConfigurationException("No entityID or acsLocation parameter supplied to remoted SessionInitiator."); - DDF ret(NULL); + DDF ret(nullptr); DDFJanitor jout(ret); // Wrap the outgoing object with a Response facade. - auto_ptr http(getResponse(ret)); + scoped_ptr http(getResponse(ret)); string relayState(in["RelayState"].string() ? in["RelayState"].string() : ""); // Since we're remoted, the result should either be a throw, which we pass on, // a false/0 return, which we just return as an empty structure, or a response/redirect, // which we capture in the facade and send back. - doRequest(*app, *http.get(), entityID, acsLocation, relayState); + doRequest(*app, nullptr, *http, entityID, acsLocation, in["authnContextClassRef"].string(), relayState); + if (!ret.isstruct()) + ret.structure(); + ret.addmember("RelayState").unsafe_string(relayState.c_str()); out << ret; } pair ADFSSessionInitiator::doRequest( const Application& app, + const HTTPRequest* httpRequest, HTTPResponse& httpResponse, const char* entityID, const char* acsLocation, + const char* authnContextClassRef, string& relayState ) const { #ifndef SHIBSP_LITE // Use metadata to invoke the SSO service directly. - MetadataProvider* m=app.getMetadataProvider(); + MetadataProvider* m = app.getMetadataProvider(); Locker locker(m); - MetadataProvider::Criteria mc(entityID, &IDPSSODescriptor::ELEMENT_QNAME, m_binding.get()); - pair entity=m->getEntityDescriptor(mc); + MetadataProviderCriteria mc(app, entityID, &IDPSSODescriptor::ELEMENT_QNAME, m_binding.get()); + pair entity = m->getEntityDescriptor(mc); if (!entity.first) { - m_log.error("unable to locate metadata for provider (%s)", entityID); + m_log.warn("unable to locate metadata for provider (%s)", entityID); throw MetadataException("Unable to locate metadata for identity provider ($entityID)", namedparams(1, "entityID", entityID)); } else if (!entity.second) { - m_log.error("unable to locate ADFS-aware identity provider role for provider (%s)", entityID); - return make_pair(false,0); + m_log.log(getParent() ? Priority::INFO : Priority::WARN, "unable to locate ADFS-aware identity provider role for provider (%s)", entityID); + if (getParent()) + return make_pair(false, 0L); + throw MetadataException("Unable to locate ADFS-aware identity provider role for provider ($entityID)", namedparams(1, "entityID", entityID)); } const EndpointType* ep = EndpointManager( dynamic_cast(entity.second)->getSingleSignOnServices() ).getByBinding(m_binding.get()); if (!ep) { - m_log.error("unable to locate compatible SSO service for provider (%s)", entityID); - return make_pair(false,0); + m_log.warn("unable to locate compatible SSO service for provider (%s)", entityID); + if (getParent()) + return make_pair(false, 0L); + throw MetadataException("Unable to locate compatible SSO service for provider ($entityID)", namedparams(1, "entityID", entityID)); } preserveRelayState(app, httpResponse, relayState); + scoped_ptr ar_event(newAuthnRequestEvent(app, httpRequest)); + if (ar_event.get()) { + ar_event->m_binding = WSFED_NS; + ar_event->m_protocol = WSFED_NS; + ar_event->m_peer = entity.first; + app.getServiceProvider().getTransactionLog()->write(*ar_event); + } + // UTC timestamp - time_t epoch=time(NULL); + time_t epoch=time(nullptr); #ifndef HAVE_GMTIME_R struct tm* ptime=gmtime(&epoch); #else @@ -473,12 +543,19 @@ pair ADFSSessionInitiator::doRequest( string req=string(dest.get()) + (strchr(dest.get(),'?') ? '&' : '?') + "wa=wsignin1.0&wreply=" + urlenc->encode(acsLocation) + "&wct=" + urlenc->encode(timebuf) + "&wtrealm=" + urlenc->encode(app.getString("entityID").second); + if (authnContextClassRef) + req += "&wauth=" + urlenc->encode(authnContextClassRef); if (!relayState.empty()) req += "&wctx=" + urlenc->encode(relayState.c_str()); + if (httpRequest) { + // If the request object is available, we're responsible for the POST data. + preservePostData(app, *httpRequest, httpResponse, relayState.c_str()); + } + return make_pair(true, httpResponse.sendRedirect(req.c_str())); #else - return make_pair(false,0); + return make_pair(false, 0L); #endif } @@ -489,7 +566,7 @@ XMLObject* ADFSDecoder::decode(string& relayState, const GenericRequest& generic #ifdef _DEBUG xmltooling::NDC ndc("decode"); #endif - Category& log = Category::getInstance(SHIBSP_LOGCAT".MessageDecoder.ADFS"); + Category& log = Category::getInstance(SHIBSP_LOGCAT ".MessageDecoder.ADFS"); log.debug("validating input"); const HTTPRequest* httpRequest=dynamic_cast(&genericRequest); @@ -513,28 +590,30 @@ XMLObject* ADFSDecoder::decode(string& relayState, const GenericRequest& generic // Parse and bind the document into an XMLObject. istringstream is(param); DOMDocument* doc = (policy.getValidating() ? XMLToolingConfig::getConfig().getValidatingParser() - : XMLToolingConfig::getConfig().getParser()).parse(is); + : XMLToolingConfig::getConfig().getParser()).parse(is); XercesJanitor janitor(doc); auto_ptr xmlObject(XMLObjectBuilder::buildOneFromElement(doc->getDocumentElement(), true)); janitor.release(); - if (!XMLHelper::isNodeNamed(xmlObject->getDOM(), m_ns.get(), RequestSecurityTokenResponse)) + if (!XMLString::equals(xmlObject->getElementQName().getLocalPart(), RequestSecurityTokenResponse)) { + log.error("unrecognized root element on message: %s", xmlObject->getElementQName().toString().c_str()); throw BindingException("Decoded message was not of the appropriate type."); + } - if (!policy.getValidating()) - SchemaValidators.validate(xmlObject.get()); + SchemaValidators.validate(xmlObject.get()); // Skip policy step here, there's no security in the wrapper. // policy.evaluate(*xmlObject.get(), &genericRequest); - + return xmlObject.release(); } -string ADFSConsumer::implementProtocol( +void ADFSConsumer::implementProtocol( const Application& application, const HTTPRequest& httpRequest, + HTTPResponse& httpResponse, SecurityPolicy& policy, - const PropertySet* settings, + const PropertySet*, const XMLObject& xmlObject ) const { @@ -546,78 +625,160 @@ string ADFSConsumer::implementProtocol( const ElementProxy* response = dynamic_cast(&xmlObject); if (!response || !response->hasChildren()) throw FatalProfileException("Incoming message was not of the proper type or contains no security token."); - response = dynamic_cast(response->getUnknownXMLObjects().front()); - if (!response || !response->hasChildren()) - throw FatalProfileException("Token wrapper element did not contain a security token."); - const saml1::Assertion* token = dynamic_cast(response->getUnknownXMLObjects().front()); - if (!token || !token->getSignature()) - throw FatalProfileException("Incoming message did not contain a signed SAML 1.1 assertion."); + + const Assertion* token = nullptr; + for (vector::const_iterator xo = response->getUnknownXMLObjects().begin(); xo != response->getUnknownXMLObjects().end(); ++xo) { + // Look for the RequestedSecurityToken element. + if (XMLString::equals((*xo)->getElementQName().getLocalPart(), RequestedSecurityToken)) { + response = dynamic_cast(*xo); + if (!response || !response->hasChildren()) + throw FatalProfileException("Token wrapper element did not contain a security token."); + token = dynamic_cast(response->getUnknownXMLObjects().front()); + if (!token || !token->getSignature()) + throw FatalProfileException("Incoming message did not contain a signed SAML assertion."); + break; + } + } // Extract message and issuer details from assertion. extractMessageDetails(*token, m_protocol.get(), policy); + // Populate recipient as audience. + const EntityDescriptor* entity = policy.getIssuerMetadata() ? dynamic_cast(policy.getIssuerMetadata()->getParent()) : nullptr; + policy.getAudiences().push_back(application.getRelyingParty(entity)->getXMLString("entityID").second); + // Run the policy over the assertion. Handles replay, freshness, and - // signature verification, assuming the relevant rules are configured. - policy.evaluate(*token); - + // signature verification, assuming the relevant rules are configured, + // along with condition enforcement. + policy.evaluate(*token, &httpRequest); + // If no security is in place now, we kick it. if (!policy.isAuthenticated()) throw SecurityPolicyException("Unable to establish security of incoming assertion."); - // Now do profile and core semantic validation to ensure we can use it for SSO. - // Profile validator. - time_t now = time(NULL); - saml1::AssertionValidator ssoValidator(application.getAudiences(), now); - ssoValidator.validateAssertion(*token); - if (!token->getConditions() || !token->getConditions()->getNotBefore() || !token->getConditions()->getNotOnOrAfter()) - throw FatalProfileException("Assertion did not contain time conditions."); - else if (token->getAuthenticationStatements().empty()) - throw FatalProfileException("Assertion did not contain an authentication statement."); - - // With ADFS, we only have one token, but we need to put it in a vector. - vector tokens(1,token); - const saml1::AuthenticationStatement* ssoStatement=token->getAuthenticationStatements().front(); + const saml1::NameIdentifier* saml1name=nullptr; + const saml1::AuthenticationStatement* saml1statement=nullptr; + const saml2::NameID* saml2name=nullptr; + const saml2::AuthnStatement* saml2statement=nullptr; + const XMLCh* authMethod=nullptr; + const XMLCh* authInstant=nullptr; + time_t now = time(nullptr), sessionExp = 0; + const PropertySet* sessionProps = application.getPropertySet("Sessions"); - // Address checking. - saml1::SubjectLocality* locality = ssoStatement->getSubjectLocality(); - if (locality && locality->getIPAddress()) { - auto_ptr_char ip(locality->getIPAddress()); - checkAddress(application, httpRequest, ip.get()); - } + const saml1::Assertion* saml1token = dynamic_cast(token); + if (saml1token) { + // Now do profile validation to ensure we can use it for SSO. + if (!saml1token->getConditions() || !saml1token->getConditions()->getNotBefore() || !saml1token->getConditions()->getNotOnOrAfter()) + throw FatalProfileException("Assertion did not contain time conditions."); + else if (saml1token->getAuthenticationStatements().empty()) + throw FatalProfileException("Assertion did not contain an authentication statement."); + + // authnskew allows rejection of SSO if AuthnInstant is too old. + pair authnskew = sessionProps ? sessionProps->getUnsignedInt("maxTimeSinceAuthn") : pair(false,0); + + saml1statement = saml1token->getAuthenticationStatements().front(); + if (saml1statement->getAuthenticationInstant()) { + if (saml1statement->getAuthenticationInstantEpoch() - XMLToolingConfig::getConfig().clock_skew_secs > now) { + throw FatalProfileException("The login time at your identity provider was future-dated."); + } + else if (authnskew.first && authnskew.second && saml1statement->getAuthenticationInstantEpoch() <= now && + (now - saml1statement->getAuthenticationInstantEpoch() > authnskew.second)) { + throw FatalProfileException("The gap between now and the time you logged into your identity provider exceeds the allowed limit."); + } + } + else if (authnskew.first && authnskew.second) { + throw FatalProfileException("Your identity provider did not supply a time of login, violating local policy."); + } - m_log.debug("ADFS profile processing completed successfully"); + // Address checking. + saml1::SubjectLocality* locality = saml1statement->getSubjectLocality(); + if (locality && locality->getIPAddress()) { + auto_ptr_char ip(locality->getIPAddress()); + checkAddress(application, httpRequest, ip.get()); + } + + saml1name = saml1statement->getSubject()->getNameIdentifier(); + authMethod = saml1statement->getAuthenticationMethod(); + if (saml1statement->getAuthenticationInstant()) + authInstant = saml1statement->getAuthenticationInstant()->getRawData(); - saml1::NameIdentifier* n = ssoStatement->getSubject()->getNameIdentifier(); + // Session expiration. + pair lifetime = sessionProps ? sessionProps->getUnsignedInt("lifetime") : pair(true,28800); + if (!lifetime.first || lifetime.second == 0) + lifetime.second = 28800; + sessionExp = now + lifetime.second; + } + else { + const saml2::Assertion* saml2token = dynamic_cast(token); + if (!saml2token) + throw FatalProfileException("Incoming message did not contain a recognized type of SAML assertion."); + + // Now do profile validation to ensure we can use it for SSO. + if (!saml2token->getConditions() || !saml2token->getConditions()->getNotBefore() || !saml2token->getConditions()->getNotOnOrAfter()) + throw FatalProfileException("Assertion did not contain time conditions."); + else if (saml2token->getAuthnStatements().empty()) + throw FatalProfileException("Assertion did not contain an authentication statement."); + + // authnskew allows rejection of SSO if AuthnInstant is too old. + pair authnskew = sessionProps ? sessionProps->getUnsignedInt("maxTimeSinceAuthn") : pair(false,0); + + saml2statement = saml2token->getAuthnStatements().front(); + if (authnskew.first && authnskew.second && + saml2statement->getAuthnInstant() && (now - saml2statement->getAuthnInstantEpoch() > authnskew.second)) + throw FatalProfileException("The gap between now and the time you logged into your identity provider exceeds the limit."); + + // Address checking. + saml2::SubjectLocality* locality = saml2statement->getSubjectLocality(); + if (locality && locality->getAddress()) { + auto_ptr_char ip(locality->getAddress()); + checkAddress(application, httpRequest, ip.get()); + } - // Now we have to extract the authentication details for attribute and session setup. + saml2name = saml2token->getSubject() ? saml2token->getSubject()->getNameID() : nullptr; + if (saml2statement->getAuthnContext() && saml2statement->getAuthnContext()->getAuthnContextClassRef()) + authMethod = saml2statement->getAuthnContext()->getAuthnContextClassRef()->getReference(); + if (saml2statement->getAuthnInstant()) + authInstant = saml2statement->getAuthnInstant()->getRawData(); + + // Session expiration for SAML 2.0 is jointly IdP- and SP-driven. + sessionExp = saml2statement->getSessionNotOnOrAfter() ? saml2statement->getSessionNotOnOrAfterEpoch() : 0; + pair lifetime = sessionProps ? sessionProps->getUnsignedInt("lifetime") : pair(true,28800); + if (!lifetime.first || lifetime.second == 0) + lifetime.second = 28800; + if (sessionExp == 0) + sessionExp = now + lifetime.second; // IdP says nothing, calulate based on SP. + else + sessionExp = min(sessionExp, now + lifetime.second); // Use the lowest. + } - // Session expiration for ADFS is purely SP-driven, and the method is mapped to a ctx class. - const PropertySet* sessionProps = application.getPropertySet("Sessions"); - pair lifetime = sessionProps ? sessionProps->getUnsignedInt("lifetime") : pair(true,28800); - if (!lifetime.first || lifetime.second == 0) - lifetime.second = 28800; + m_log.debug("ADFS profile processing completed successfully"); // We've successfully "accepted" the SSO token. // To complete processing, we need to extract and resolve attributes and then create the session. - // Normalize the SAML 1.x NameIdentifier... - auto_ptr nameid(n ? saml2::NameIDBuilder::buildNameID() : NULL); - if (n) { - nameid->setName(n->getName()); - nameid->setFormat(n->getFormat()); - nameid->setNameQualifier(n->getNameQualifier()); + // Normalize a SAML 1.x NameIdentifier... + scoped_ptr nameid(saml1name ? saml2::NameIDBuilder::buildNameID() : nullptr); + if (saml1name) { + nameid->setName(saml1name->getName()); + nameid->setFormat(saml1name->getFormat()); + nameid->setNameQualifier(saml1name->getNameQualifier()); } // The context will handle deleting attributes and new tokens. - auto_ptr ctx( + vector tokens(1,token); + scoped_ptr ctx( resolveAttributes( application, + &httpRequest, policy.getIssuerMetadata(), m_protocol.get(), - n, - nameid.get(), - ssoStatement->getAuthenticationMethod(), - NULL, + nullptr, + saml1name, + saml1statement, + (saml1name ? nameid.get() : saml2name), + saml2statement, + authMethod, + nullptr, &tokens ) ); @@ -627,20 +788,37 @@ string ADFSConsumer::implementProtocol( tokens.insert(tokens.end(), ctx->getResolvedAssertions().begin(), ctx->getResolvedAssertions().end()); } - return application.getServiceProvider().getSessionCache()->insert( - now + lifetime.second, + string session_id; + application.getServiceProvider().getSessionCache()->insert( + session_id, application, - httpRequest.getRemoteAddr().c_str(), - policy.getIssuerMetadata() ? dynamic_cast(policy.getIssuerMetadata()->getParent()) : NULL, + httpRequest, + httpResponse, + sessionExp, + entity, m_protocol.get(), - nameid.get(), - ssoStatement->getAuthenticationInstant() ? ssoStatement->getAuthenticationInstant()->getRawData() : NULL, - NULL, - ssoStatement->getAuthenticationMethod(), - NULL, + (saml1name ? nameid.get() : saml2name), + authInstant, + nullptr, + authMethod, + nullptr, &tokens, - ctx.get() ? &ctx->getResolvedAttributes() : NULL + ctx ? &ctx->getResolvedAttributes() : nullptr ); + + scoped_ptr login_event(newLoginEvent(application, httpRequest)); + if (login_event) { + login_event->m_sessionID = session_id.c_str(); + login_event->m_peer = entity; + login_event->m_protocol = WSFED_NS; + login_event->m_binding = WSFED_NS; + login_event->m_saml1AuthnStatement = saml1statement; + login_event->m_nameID = (saml1name ? nameid.get() : saml2name); + login_event->m_saml2AuthnStatement = saml2statement; + if (ctx) + login_event->m_attributes = &ctx->getResolvedAttributes(); + application.getServiceProvider().getTransactionLog()->write(*login_event); + } } #endif @@ -653,38 +831,34 @@ pair ADFSLogoutInitiator::run(SPRequest& request, bool isHandler) con // Basically we have no way to tell in the Logout receiving handler whether // we initiated the logout or not. - Session* session = NULL; + Session* session = nullptr; try { session = request.getSession(false, true, false); // don't cache it and ignore all checks if (!session) - return make_pair(false,0); + return make_pair(false, 0L); // We only handle ADFS sessions. if (!XMLString::equals(session->getProtocol(), WSFED_NS) || !session->getEntityID()) { session->unlock(); - return make_pair(false,0); + return make_pair(false, 0L); } } - catch (exception& ex) { + catch (std::exception& ex) { m_log.error("error accessing current session: %s", ex.what()); - return make_pair(false,0); + return make_pair(false,0L); } - string entityID(session->getEntityID()); - session->unlock(); - if (SPConfig::getConfig().isEnabled(SPConfig::OutOfProcess)) { // When out of process, we run natively. - return doRequest(request.getApplication(), request.getRequestURL(), entityID.c_str(), request); + return doRequest(request.getApplication(), request, request, session); } else { // When not out of process, we remote the request. - Locker locker(session, false); - DDF out,in(m_address.c_str()); + session->unlock(); + vector headers(1,"Cookie"); + headers.push_back("User-Agent"); + DDF out,in = wrap(request, &headers); DDFJanitor jin(in), jout(out); - in.addmember("application_id").string(request.getApplication().getId()); - in.addmember("url").string(request.getRequestURL()); - in.addmember("entity_id").string(entityID.c_str()); out=request.getServiceProvider().getListenerService()->send(in); return unwrap(request, out); } @@ -693,25 +867,49 @@ pair ADFSLogoutInitiator::run(SPRequest& request, bool isHandler) con void ADFSLogoutInitiator::receive(DDF& in, ostream& out) { #ifndef SHIBSP_LITE + // Defer to base class for notifications + if (in["notify"].integer() == 1) + return LogoutHandler::receive(in, out); + // Find application. - const char* aid=in["application_id"].string(); - const Application* app=aid ? SPConfig::getConfig().getServiceProvider()->getApplication(aid) : NULL; + const char* aid = in["application_id"].string(); + const Application* app = aid ? SPConfig::getConfig().getServiceProvider()->getApplication(aid) : nullptr; if (!app) { // Something's horribly wrong. m_log.error("couldn't find application (%s) for logout", aid ? aid : "(missing)"); throw ConfigurationException("Unable to locate application for logout, deleted?"); } - + + // Unpack the request. + scoped_ptr req(getRequest(in)); + // Set up a response shim. - DDF ret(NULL); + DDF ret(nullptr); DDFJanitor jout(ret); - auto_ptr resp(getResponse(ret)); - - // Since we're remoted, the result should either be a throw, which we pass on, - // a false/0 return, which we just return as an empty structure, or a response/redirect, - // which we capture in the facade and send back. - doRequest(*app, in["url"].string(), in["entity_id"].string(), *resp.get()); + scoped_ptr resp(getResponse(ret)); + Session* session = nullptr; + try { + session = app->getServiceProvider().getSessionCache()->find(*app, *req, nullptr, nullptr); + } + catch (std::exception& ex) { + m_log.error("error accessing current session: %s", ex.what()); + } + + // With no session, we just skip the request and let it fall through to an empty struct return. + if (session) { + if (session->getEntityID()) { + // Since we're remoted, the result should either be a throw, which we pass on, + // a false/0 return, which we just return as an empty structure, or a response/redirect, + // which we capture in the facade and send back. + doRequest(*app, *req, *resp, session); + } + else { + m_log.error("no issuing entityID found in session"); + session->unlock(); + app->getServiceProvider().getSessionCache()->remove(*app, *req, resp.get()); + } + } out << ret; #else throw ConfigurationException("Cannot perform logout using lite version of shibsp library."); @@ -719,23 +917,46 @@ void ADFSLogoutInitiator::receive(DDF& in, ostream& out) } pair ADFSLogoutInitiator::doRequest( - const Application& application, const char* requestURL, const char* entityID, HTTPResponse& response + const Application& application, const HTTPRequest& httpRequest, HTTPResponse& httpResponse, Session* session ) const { + Locker sessionLocker(session, false); + + // Do back channel notification. + vector sessions(1, session->getID()); + if (!notifyBackChannel(application, httpRequest.getRequestURL(), sessions, false)) { #ifndef SHIBSP_LITE - try { - if (!entityID) - throw ConfigurationException("Missing entityID parameter."); + scoped_ptr logout_event(newLogoutEvent(application, &httpRequest, session)); + if (logout_event) { + logout_event->m_logoutType = LogoutEvent::LOGOUT_EVENT_PARTIAL; + application.getServiceProvider().getTransactionLog()->write(*logout_event); + } +#endif + sessionLocker.assign(); + session = nullptr; + application.getServiceProvider().getSessionCache()->remove(application, httpRequest, &httpResponse); + return sendLogoutPage(application, httpRequest, httpResponse, "partial"); + } + +#ifndef SHIBSP_LITE + pair ret = make_pair(false, 0L); + try { // With a session in hand, we can create a request message, if we can find a compatible endpoint. - MetadataProvider* m=application.getMetadataProvider(); - Locker locker(m); - MetadataProvider::Criteria mc(entityID, &IDPSSODescriptor::ELEMENT_QNAME, m_binding.get()); + MetadataProvider* m = application.getMetadataProvider(); + Locker metadataLocker(m); + MetadataProviderCriteria mc(application, session->getEntityID(), &IDPSSODescriptor::ELEMENT_QNAME, m_binding.get()); pair entity=m->getEntityDescriptor(mc); - if (!entity.first) - throw MetadataException("Unable to locate metadata for identity provider ($entityID)", namedparams(1, "entityID", entityID)); - else if (!entity.second) - throw MetadataException("Unable to locate ADFS IdP role for identity provider ($entityID).", namedparams(1, "entityID", entityID)); + if (!entity.first) { + throw MetadataException( + "Unable to locate metadata for identity provider ($entityID)", namedparams(1, "entityID", session->getEntityID()) + ); + } + else if (!entity.second) { + throw MetadataException( + "Unable to locate ADFS IdP role for identity provider ($entityID).", namedparams(1, "entityID", session->getEntityID()) + ); + } const EndpointType* ep = EndpointManager( dynamic_cast(entity.second)->getSingleLogoutServices() @@ -743,20 +964,52 @@ pair ADFSLogoutInitiator::doRequest( if (!ep) { throw MetadataException( "Unable to locate ADFS single logout service for identity provider ($entityID).", - namedparams(1, "entityID", entityID) + namedparams(1, "entityID", session->getEntityID()) ); } - auto_ptr_char dest(ep->getLocation()); + const char* returnloc = httpRequest.getParameter("return"); + if (returnloc) + application.limitRedirect(httpRequest, returnloc); + // Log the request. + scoped_ptr logout_event(newLogoutEvent(application, &httpRequest, session)); + if (logout_event) { + logout_event->m_logoutType = LogoutEvent::LOGOUT_EVENT_UNKNOWN; + application.getServiceProvider().getTransactionLog()->write(*logout_event); + } + + auto_ptr_char dest(ep->getLocation()); string req=string(dest.get()) + (strchr(dest.get(),'?') ? '&' : '?') + "wa=wsignout1.0"; - return make_pair(true,response.sendRedirect(req.c_str())); + if (returnloc) { + req += "&wreply="; + if (*returnloc == '/') { + string s(returnloc); + httpRequest.absolutize(s); + req += XMLToolingConfig::getConfig().getURLEncoder()->encode(s.c_str()); + } + else { + req += XMLToolingConfig::getConfig().getURLEncoder()->encode(returnloc); + } + } + ret.second = httpResponse.sendRedirect(req.c_str()); + ret.first = true; + + if (session) { + sessionLocker.assign(); + session = nullptr; + application.getServiceProvider().getSessionCache()->remove(application, httpRequest, &httpResponse); + } } - catch (exception& ex) { + catch (MetadataException& mex) { + // Less noise for IdPs that don't support logout + m_log.info("unable to issue ADFS logout request: %s", mex.what()); + } + catch (std::exception& ex) { m_log.error("error issuing ADFS logout request: %s", ex.what()); } - return make_pair(false,0); + return ret; #else throw ConfigurationException("Cannot perform logout using lite version of shibsp library."); #endif @@ -777,7 +1030,7 @@ pair ADFSLogout::run(SPRequest& request, bool isHandler) const if (!strcmp(param, "wsignin1.0")) return m_login.run(request, isHandler); else if (strcmp(param, "wsignout1.0") && strcmp(param, "wsignoutcleanup1.0")) - throw FatalProfileException("Unsupported WS-Federation action paremeter ($1).", params(1, param)); + throw FatalProfileException("Unsupported WS-Federation action parameter ($1).", params(1, param)); } else if (strcmp(request.getMethod(),"GET") || !request.getParameter("notifying")) throw FatalProfileException("Unsupported request to ADFS protocol endpoint."); @@ -787,10 +1040,6 @@ pair ADFSLogout::run(SPRequest& request, bool isHandler) const param = request.getParameter("wreply"); const Application& app = request.getApplication(); - // Get the session_id. - pair shib_cookie = app.getCookieNameProps("_shibsession_"); - const char* session_id = request.getCookie(shib_cookie.first.c_str()); - if (!returning) { // Pass control to the first front channel notification point, if any. map parammap; @@ -802,19 +1051,28 @@ pair ADFSLogout::run(SPRequest& request, bool isHandler) const } // Best effort on back channel and to remove the user agent's session. - if (session_id) { + string session_id = app.getServiceProvider().getSessionCache()->active(app, request); + if (!session_id.empty()) { vector sessions(1,session_id); notifyBackChannel(app, request.getRequestURL(), sessions, false); try { - app.getServiceProvider().getSessionCache()->remove(session_id, app); + app.getServiceProvider().getSessionCache()->remove(app, request, &request); } - catch (exception& ex) { - m_log.error("error removing session (%s): %s", session_id, ex.what()); + catch (std::exception& ex) { + m_log.error("error removing session (%s): %s", session_id.c_str(), ex.what()); } - request.setCookie(shib_cookie.first.c_str(), shib_cookie.second); } - if (param) - return make_pair(true, request.sendRedirect(param)); - return sendLogoutPage(app, request, false, "Logout complete."); + if (param) { + if (*param == '/') { + string p(param); + request.absolutize(p); + return make_pair(true, request.sendRedirect(p.c_str())); + } + else { + app.limitRedirect(request, param); + return make_pair(true, request.sendRedirect(param)); + } + } + return sendLogoutPage(app, request, request, "global"); }