X-Git-Url: http://www.project-moonshot.org/gitweb/?a=blobdiff_plain;f=isapi_shib%2Fisapi_shib.cpp;h=014f34c63647aefbb001d3ca9deed888f51272f9;hb=7df2bffd1483435a8b5b8c28f25712786d60a9ef;hp=06366870c9d4943184a12a180449a2053da16607;hpb=99b4e9b524107f7fd1e13563c0c37a36b5c9654f;p=shibboleth%2Fsp.git

diff --git a/isapi_shib/isapi_shib.cpp b/isapi_shib/isapi_shib.cpp
index 0636687..014f34c 100644
--- a/isapi_shib/isapi_shib.cpp
+++ b/isapi_shib/isapi_shib.cpp
@@ -1,6 +1,6 @@
 /*
- *  Copyright 2001-2005 Internet2
- * 
+ *  Copyright 2001-2010 Internet2
+ *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
@@ -14,82 +14,91 @@
  * limitations under the License.
  */
 
-/* isapi_shib.cpp - Shibboleth ISAPI filter
-
-   Scott Cantor
-   8/23/02
-*/
+/**
+ * isapi_shib.cpp
+ *
+ * Shibboleth ISAPI filter.
+ */
 
+#define SHIBSP_LITE
 #include "config_win32.h"
 
 #define _CRT_NONSTDC_NO_DEPRECATE 1
 #define _CRT_SECURE_NO_DEPRECATE 1
+#define _CRT_RAND_S
 
+#include <shibsp/exceptions.h>
+#include <shibsp/AbstractSPRequest.h>
 #include <shibsp/SPConfig.h>
+#include <shibsp/ServiceProvider.h>
 
-// SAML Runtime
-#include <saml/saml.h>
-#include <shib/shib.h>
-#include <shib-target/shib-target.h>
-
-#include <ctime>
-#include <fstream>
+#include <set>
 #include <sstream>
+#include <fstream>
 #include <stdexcept>
 #include <process.h>
-
+#include <xmltooling/unicode.h>
+#include <xmltooling/XMLToolingConfig.h>
+#include <xmltooling/util/NDC.h>
+#include <xmltooling/util/XMLConstants.h>
+#include <xmltooling/util/XMLHelper.h>
+#include <xercesc/util/Base64.hpp>
+#include <xercesc/util/XMLUniDefs.hpp>
+
+#include <windows.h>
 #include <httpfilt.h>
 #include <httpext.h>
 
 using namespace shibsp;
-using namespace shibtarget;
 using namespace xmltooling;
+using namespace xercesc;
 using namespace std;
 
 // globals
 namespace {
-    static const XMLCh name[] = { chLatin_n, chLatin_a, chLatin_m, chLatin_e, chNull };
-    static const XMLCh port[] = { chLatin_p, chLatin_o, chLatin_r, chLatin_t, chNull };
-    static const XMLCh sslport[] = { chLatin_s, chLatin_s, chLatin_l, chLatin_p, chLatin_o, chLatin_r, chLatin_t, chNull };
-    static const XMLCh scheme[] = { chLatin_s, chLatin_c, chLatin_h, chLatin_e, chLatin_m, chLatin_e, chNull };
-    static const XMLCh id[] = { chLatin_i, chLatin_d, chNull };
-    static const XMLCh Implementation[] =
-    { chLatin_I, chLatin_m, chLatin_p, chLatin_l, chLatin_e, chLatin_m, chLatin_e, chLatin_n, chLatin_t, chLatin_a, chLatin_t, chLatin_i, chLatin_o, chLatin_n, chNull };
-    static const XMLCh ISAPI[] = { chLatin_I, chLatin_S, chLatin_A, chLatin_P, chLatin_I, chNull };
-    static const XMLCh Alias[] = { chLatin_A, chLatin_l, chLatin_i, chLatin_a, chLatin_s, chNull };
-    static const XMLCh normalizeRequest[] =
-    { chLatin_n, chLatin_o, chLatin_r, chLatin_m, chLatin_a, chLatin_l, chLatin_i, chLatin_z, chLatin_e,
-      chLatin_R, chLatin_e, chLatin_q, chLatin_u, chLatin_e, chLatin_s, chLatin_t, chNull
-    };
-    static const XMLCh Site[] = { chLatin_S, chLatin_i, chLatin_t, chLatin_e, chNull };
+    static const XMLCh path[] =             UNICODE_LITERAL_4(p,a,t,h);
+    static const XMLCh validate[] =         UNICODE_LITERAL_8(v,a,l,i,d,a,t,e);
+    static const XMLCh name[] =             UNICODE_LITERAL_4(n,a,m,e);
+    static const XMLCh port[] =             UNICODE_LITERAL_4(p,o,r,t);
+    static const XMLCh sslport[] =          UNICODE_LITERAL_7(s,s,l,p,o,r,t);
+    static const XMLCh scheme[] =           UNICODE_LITERAL_6(s,c,h,e,m,e);
+    static const XMLCh id[] =               UNICODE_LITERAL_2(i,d);
+    static const XMLCh Alias[] =            UNICODE_LITERAL_5(A,l,i,a,s);
+    static const XMLCh Site[] =             UNICODE_LITERAL_4(S,i,t,e);
 
     struct site_t {
         site_t(const DOMElement* e)
         {
-            auto_ptr_char n(e->getAttributeNS(NULL,name));
-            auto_ptr_char s(e->getAttributeNS(NULL,scheme));
-            auto_ptr_char p(e->getAttributeNS(NULL,port));
-            auto_ptr_char p2(e->getAttributeNS(NULL,sslport));
+            auto_ptr_char n(e->getAttributeNS(nullptr,name));
+            auto_ptr_char s(e->getAttributeNS(nullptr,scheme));
+            auto_ptr_char p(e->getAttributeNS(nullptr,port));
+            auto_ptr_char p2(e->getAttributeNS(nullptr,sslport));
             if (n.get()) m_name=n.get();
             if (s.get()) m_scheme=s.get();
             if (p.get()) m_port=p.get();
             if (p2.get()) m_sslport=p2.get();
-            DOMNodeList* nlist=e->getElementsByTagNameNS(shibtarget::XML::SHIBTARGET_NS,Alias);
-            for (unsigned int i=0; nlist && i<nlist->getLength(); i++) {
-                if (nlist->item(i)->hasChildNodes()) {
-                    auto_ptr_char alias(nlist->item(i)->getFirstChild()->getNodeValue());
+            e = XMLHelper::getFirstChildElement(e, Alias);
+            while (e) {
+                if (e->hasChildNodes()) {
+                    auto_ptr_char alias(e->getFirstChild()->getNodeValue());
                     m_aliases.insert(alias.get());
                 }
+                e = XMLHelper::getNextSiblingElement(e, Alias);
             }
         }
         string m_scheme,m_port,m_sslport,m_name;
         set<string> m_aliases;
     };
-    
+
     HINSTANCE g_hinstDLL;
-    ShibTargetConfig* g_Config = NULL;
+    SPConfig* g_Config = nullptr;
     map<string,site_t> g_Sites;
     bool g_bNormalizeRequest = true;
+    string g_unsetHeaderValue,g_spoofKey;
+    bool g_checkSpoofing = true;
+    bool g_catchAll = false;
+    bool g_bSafeHeaderNames = false;
+    vector<string> g_NoCerts;
 }
 
 BOOL LogEvent(
@@ -99,13 +108,24 @@ BOOL LogEvent(
     PSID  lpUserSid,
     LPCSTR  message)
 {
-    LPCSTR  messages[] = {message, NULL};
-    
+    LPCSTR  messages[] = {message, nullptr};
+
     HANDLE hElog = RegisterEventSource(lpUNCServerName, "Shibboleth ISAPI Filter");
-    BOOL res = ReportEvent(hElog, wType, 0, dwEventID, lpUserSid, 1, 0, messages, NULL);
+    BOOL res = ReportEvent(hElog, wType, 0, dwEventID, lpUserSid, 1, 0, messages, nullptr);
     return (DeregisterEventSource(hElog) && res);
 }
 
+void _my_invalid_parameter_handler(
+   const wchar_t * expression,
+   const wchar_t * function,
+   const wchar_t * file,
+   unsigned int line,
+   uintptr_t pReserved
+   )
+{
+    return;
+}
+
 extern "C" __declspec(dllexport) BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID)
 {
     if (fdwReason==DLL_PROCESS_ATTACH)
@@ -117,10 +137,9 @@ extern "C" BOOL WINAPI GetExtensionVersion(HSE_VERSION_INFO* pVer)
 {
     if (!pVer)
         return FALSE;
-        
-    if (!g_Config)
-    {
-        LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL,
+
+    if (!g_Config) {
+        LogEvent(nullptr, EVENTLOG_ERROR_TYPE, 2100, nullptr,
                 "Extension mode startup not possible, is the DLL loaded as a filter?");
         return FALSE;
     }
@@ -140,72 +159,93 @@ extern "C" BOOL WINAPI GetFilterVersion(PHTTP_FILTER_VERSION pVer)
     if (!pVer)
         return FALSE;
     else if (g_Config) {
-        LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL,
+        LogEvent(nullptr, EVENTLOG_ERROR_TYPE, 2100, nullptr,
                 "Reentrant filter initialization, ignoring...");
         return TRUE;
     }
 
-#ifndef _DEBUG
-    try
-    {
-#endif
-        LPCSTR schemadir=getenv("SHIBSCHEMAS");
-        if (!schemadir)
-            schemadir=SHIB_SCHEMAS;
-        LPCSTR config=getenv("SHIBCONFIG");
-        if (!config)
-            config=SHIB_CONFIG;
-        g_Config=&ShibTargetConfig::getConfig();
-        SPConfig::getConfig().setFeatures(
-            SPConfig::Listener |
-            SPConfig::Caching |
-            SPConfig::Metadata |
-            SPConfig::AAP |
-            SPConfig::RequestMapper |
-            SPConfig::InProcess |
-            SPConfig::Logging
-            );
-        if (!g_Config->init(schemadir)) {
-            g_Config=NULL;
-            LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL,
-                    "Filter startup failed during library initialization, check native log for help.");
-            return FALSE;
-        }
-        else if (!g_Config->load(config)) {
-            g_Config=NULL;
-            LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL,
-                    "Filter startup failed to load configuration, check native log for help.");
-            return FALSE;
+    g_Config=&SPConfig::getConfig();
+    g_Config->setFeatures(
+        SPConfig::Listener |
+        SPConfig::Caching |
+        SPConfig::RequestMapping |
+        SPConfig::InProcess |
+        SPConfig::Logging |
+        SPConfig::Handlers
+        );
+    if (!g_Config->init()) {
+        g_Config=nullptr;
+        LogEvent(nullptr, EVENTLOG_ERROR_TYPE, 2100, nullptr,
+                "Filter startup failed during library initialization, check native log for help.");
+        return FALSE;
+    }
+
+    try {
+        if (!g_Config->instantiate(nullptr, true))
+            throw runtime_error("unknown error");
+    }
+    catch (exception& ex) {
+        g_Config->term();
+        g_Config=nullptr;
+        LogEvent(nullptr, EVENTLOG_ERROR_TYPE, 2100, nullptr, ex.what());
+        LogEvent(nullptr, EVENTLOG_ERROR_TYPE, 2100, nullptr,
+                "Filter startup failed to load configuration, check native log for details.");
+        return FALSE;
+    }
+
+    // Access implementation-specifics and site mappings.
+    ServiceProvider* sp=g_Config->getServiceProvider();
+    Locker locker(sp);
+    const PropertySet* props=sp->getPropertySet("InProcess");
+    if (props) {
+        pair<bool,bool> flag=props->getBool("checkSpoofing");
+        g_checkSpoofing = !flag.first || flag.second;
+        flag=props->getBool("catchAll");
+        g_catchAll = flag.first && flag.second;
+
+        pair<bool,const char*> unsetValue=props->getString("unsetHeaderValue");
+        if (unsetValue.first)
+            g_unsetHeaderValue = unsetValue.second;
+        if (g_checkSpoofing) {
+            unsetValue = props->getString("spoofKey");
+            if (unsetValue.first)
+                g_spoofKey = unsetValue.second;
+            else {
+                _invalid_parameter_handler old = _set_invalid_parameter_handler(_my_invalid_parameter_handler);
+                unsigned int randkey=0,randkey2=0,randkey3=0,randkey4=0;
+                if (rand_s(&randkey) == 0 && rand_s(&randkey2) == 0 && rand_s(&randkey3) == 0 && rand_s(&randkey4) == 0) {
+                    _set_invalid_parameter_handler(old);
+                    ostringstream keystr;
+                    keystr << randkey << randkey2 << randkey3 << randkey4;
+                    g_spoofKey = keystr.str();
+                }
+                else {
+                    _set_invalid_parameter_handler(old);
+                    LogEvent(nullptr, EVENTLOG_ERROR_TYPE, 2100, nullptr,
+                            "Filter failed to generate a random anti-spoofing key (if this is Windows 2000 set one manually).");
+                    locker.assign();    // pops lock on SP config
+                    g_Config->term();
+                    g_Config=nullptr;
+                    return FALSE;
+                }
+            }
         }
-        
-        // Access the implementation-specifics for site mappings.
-        IConfig* conf=g_Config->getINI();
-        saml::Locker locker(conf);
-        const PropertySet* props=conf->getPropertySet("Local");
+
+        props = props->getPropertySet("ISAPI");
         if (props) {
-            const DOMElement* impl=saml::XML::getFirstChildElement(
-                props->getElement(),shibtarget::XML::SHIBTARGET_NS,Implementation
-                );
-            if (impl && (impl=saml::XML::getFirstChildElement(impl,shibtarget::XML::SHIBTARGET_NS,ISAPI))) {
-                const XMLCh* flag=impl->getAttributeNS(NULL,normalizeRequest);
-                g_bNormalizeRequest=(!flag || !*flag || *flag==chDigit_1 || *flag==chLatin_t);
-                impl=saml::XML::getFirstChildElement(impl,shibtarget::XML::SHIBTARGET_NS,Site);
-                while (impl) {
-                    auto_ptr_char id(impl->getAttributeNS(NULL,id));
-                    if (id.get())
-                        g_Sites.insert(pair<string,site_t>(id.get(),site_t(impl)));
-                    impl=saml::XML::getNextSiblingElement(impl,shibtarget::XML::SHIBTARGET_NS,Site);
-                }
+            flag = props->getBool("normalizeRequest");
+            g_bNormalizeRequest = !flag.first || flag.second;
+            flag = props->getBool("safeHeaderNames");
+            g_bSafeHeaderNames = flag.first && flag.second;
+            const DOMElement* child = XMLHelper::getFirstChildElement(props->getElement(),Site);
+            while (child) {
+                auto_ptr_char id(child->getAttributeNS(nullptr,id));
+                if (id.get())
+                    g_Sites.insert(pair<string,site_t>(id.get(),site_t(child)));
+                child=XMLHelper::getNextSiblingElement(child,Site);
             }
         }
-#ifndef _DEBUG
     }
-    catch (...)
-    {
-        LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, "Filter startup failed with an exception.");
-        return FALSE;
-    }
-#endif
 
     pVer->dwFilterVersion=HTTP_FILTER_REVISION;
     strncpy(pVer->lpszFilterDesc,"Shibboleth ISAPI Filter",SF_MAX_FILTER_DESC_LEN);
@@ -214,16 +254,16 @@ extern "C" BOOL WINAPI GetFilterVersion(PHTTP_FILTER_VERSION pVer)
                    SF_NOTIFY_NONSECURE_PORT |
                    SF_NOTIFY_PREPROC_HEADERS |
                    SF_NOTIFY_LOG);
-    LogEvent(NULL, EVENTLOG_INFORMATION_TYPE, 7701, NULL, "Filter initialized...");
+    LogEvent(nullptr, EVENTLOG_INFORMATION_TYPE, 7701, nullptr, "Filter initialized...");
     return TRUE;
 }
 
 extern "C" BOOL WINAPI TerminateFilter(DWORD)
 {
     if (g_Config)
-        g_Config->shutdown();
-    g_Config = NULL;
-    LogEvent(NULL, EVENTLOG_INFORMATION_TYPE, 7701, NULL, "Filter shut down...");
+        g_Config->term();
+    g_Config = nullptr;
+    LogEvent(nullptr, EVENTLOG_INFORMATION_TYPE, 7701, nullptr, "Filter shut down...");
     return TRUE;
 }
 
@@ -240,7 +280,7 @@ extern "C" BOOL WINAPI TerminateFilter(DWORD)
 class dynabuf
 {
 public:
-    dynabuf() { bufptr=NULL; buflen=0; }
+    dynabuf() { bufptr=nullptr; buflen=0; }
     dynabuf(size_t s) { bufptr=new char[buflen=s]; *bufptr=0; }
     ~dynabuf() { delete[] bufptr; }
     size_t length() const { return bufptr ? strlen(bufptr) : 0; }
@@ -271,21 +311,19 @@ void dynabuf::reserve(size_t s, bool keep)
 
 bool dynabuf::operator==(const char* s) const
 {
-    if (buflen==NULL || s==NULL)
-        return (buflen==NULL && s==NULL);
+    if (buflen==0 || s==nullptr)
+        return (buflen==0 && s==nullptr);
     else
         return strcmp(bufptr,s)==0;
 }
 
 void GetServerVariable(PHTTP_FILTER_CONTEXT pfc, LPSTR lpszVariable, dynabuf& s, DWORD size=80, bool bRequired=true)
-    throw (bad_alloc, DWORD)
 {
     s.reserve(size);
     s.erase();
     size=s.size();
 
-    while (!pfc->GetServerVariable(pfc,lpszVariable,s,&size))
-    {
+    while (!pfc->GetServerVariable(pfc,lpszVariable,s,&size)) {
         // Grumble. Check the error.
         DWORD e=GetLastError();
         if (e==ERROR_INSUFFICIENT_BUFFER)
@@ -298,14 +336,12 @@ void GetServerVariable(PHTTP_FILTER_CONTEXT pfc, LPSTR lpszVariable, dynabuf& s,
 }
 
 void GetServerVariable(LPEXTENSION_CONTROL_BLOCK lpECB, LPSTR lpszVariable, dynabuf& s, DWORD size=80, bool bRequired=true)
-    throw (bad_alloc, DWORD)
 {
     s.reserve(size);
     s.erase();
     size=s.size();
 
-    while (!lpECB->GetServerVariable(lpECB->ConnID,lpszVariable,s,&size))
-    {
+    while (!lpECB->GetServerVariable(lpECB->ConnID,lpszVariable,s,&size)) {
         // Grumble. Check the error.
         DWORD e=GetLastError();
         if (e==ERROR_INSUFFICIENT_BUFFER)
@@ -319,14 +355,12 @@ void GetServerVariable(LPEXTENSION_CONTROL_BLOCK lpECB, LPSTR lpszVariable, dyna
 
 void GetHeader(PHTTP_FILTER_PREPROC_HEADERS pn, PHTTP_FILTER_CONTEXT pfc,
                LPSTR lpszName, dynabuf& s, DWORD size=80, bool bRequired=true)
-    throw (bad_alloc, DWORD)
 {
     s.reserve(size);
     s.erase();
     size=s.size();
 
-    while (!pn->GetHeader(pfc,lpszName,s,&size))
-    {
+    while (!pn->GetHeader(pfc,lpszName,s,&size)) {
         // Grumble. Check the error.
         DWORD e=GetLastError();
         if (e==ERROR_INSUFFICIENT_BUFFER)
@@ -341,139 +375,229 @@ void GetHeader(PHTTP_FILTER_PREPROC_HEADERS pn, PHTTP_FILTER_CONTEXT pfc,
 /****************************************************************************/
 // ISAPI Filter
 
-class ShibTargetIsapiF : public ShibTarget
+class ShibTargetIsapiF : public AbstractSPRequest
 {
   PHTTP_FILTER_CONTEXT m_pfc;
   PHTTP_FILTER_PREPROC_HEADERS m_pn;
-  string m_cookie;
+  multimap<string,string> m_headers;
+  int m_port;
+  string m_scheme,m_hostname;
+  mutable string m_remote_addr,m_content_type,m_method;
+  dynabuf m_allhttp;
+  bool m_firsttime;
+
 public:
-  ShibTargetIsapiF(PHTTP_FILTER_CONTEXT pfc, PHTTP_FILTER_PREPROC_HEADERS pn, const site_t& site) {
+  ShibTargetIsapiF(PHTTP_FILTER_CONTEXT pfc, PHTTP_FILTER_PREPROC_HEADERS pn, const site_t& site)
+      : AbstractSPRequest(SHIBSP_LOGCAT".ISAPI"), m_pfc(pfc), m_pn(pn), m_allhttp(4096), m_firsttime(true) {
 
     // URL path always come from IIS.
-    dynabuf url(256);
-    GetHeader(pn,pfc,"url",url,256,false);
+    dynabuf var(256);
+    GetHeader(pn,pfc,"url",var,256,false);
+    setRequestURI(var);
 
     // Port may come from IIS or from site def.
-    dynabuf port(11);
-    if (!g_bNormalizeRequest || (pfc->fIsSecurePort && site.m_sslport.empty()) || (!pfc->fIsSecurePort && site.m_port.empty()))
-        GetServerVariable(pfc,"SERVER_PORT",port,10);
+    if (!g_bNormalizeRequest || (pfc->fIsSecurePort && site.m_sslport.empty()) || (!pfc->fIsSecurePort && site.m_port.empty())) {
+        GetServerVariable(pfc,"SERVER_PORT",var,10);
+        m_port = atoi(var);
+    }
     else if (pfc->fIsSecurePort) {
-        strncpy(port,site.m_sslport.c_str(),10);
-        static_cast<char*>(port)[10]=0;
+        m_port = atoi(site.m_sslport.c_str());
     }
     else {
-        strncpy(port,site.m_port.c_str(),10);
-        static_cast<char*>(port)[10]=0;
+        m_port = atoi(site.m_port.c_str());
     }
-    
+
     // Scheme may come from site def or be derived from IIS.
-    const char* scheme=site.m_scheme.c_str();
-    if (!scheme || !*scheme || !g_bNormalizeRequest)
-        scheme=pfc->fIsSecurePort ? "https" : "http";
+    m_scheme=site.m_scheme;
+    if (m_scheme.empty() || !g_bNormalizeRequest)
+        m_scheme=pfc->fIsSecurePort ? "https" : "http";
 
-    // Get the rest of the server variables.
-    dynabuf remote_addr(16),method(5),content_type(32),hostname(32);
-    GetServerVariable(pfc,"SERVER_NAME",hostname,32);
-    GetServerVariable(pfc,"REMOTE_ADDR",remote_addr,16);
-    GetServerVariable(pfc,"REQUEST_METHOD",method,5,false);
-    GetServerVariable(pfc,"CONTENT_TYPE",content_type,32,false);
+    GetServerVariable(pfc,"SERVER_NAME",var,32);
 
     // Make sure SERVER_NAME is "authorized" for use on this site. If not, set to canonical name.
-    const char* host=hostname;
-    if (site.m_name!=host && site.m_aliases.find(host)==site.m_aliases.end())
-        host=site.m_name.c_str();
-
-    init(scheme, host, atoi(port), url, content_type, remote_addr, method); 
+    m_hostname = var;
+    if (site.m_name!=m_hostname && site.m_aliases.find(m_hostname)==site.m_aliases.end())
+        m_hostname=site.m_name;
+
+    if (!g_spoofKey.empty()) {
+        GetHeader(pn, pfc, "ShibSpoofCheck:", var, 32, false);
+        if (!var.empty() && g_spoofKey == (char*)var)
+            m_firsttime = false;
+    }
 
-    m_pfc = pfc;
-    m_pn = pn;
+    if (!m_firsttime)
+        log(SPDebug, "ISAPI filter running more than once");
   }
   ~ShibTargetIsapiF() { }
 
-  virtual void log(ShibLogLevel level, const string &msg) {
-    ShibTarget::log(level,msg);
-    if (level == LogLevelError)
-        LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, msg.c_str());
+  const char* getScheme() const {
+    return m_scheme.c_str();
   }
-  virtual string getCookies() const {
-    dynabuf buf(128);
-    GetHeader(m_pn, m_pfc, "Cookie:", buf, 128, false);
-    return buf.empty() ? "" : buf;
+  const char* getHostname() const {
+    return m_hostname.c_str();
+  }
+  int getPort() const {
+    return m_port;
+  }
+  const char* getQueryString() const {
+      const char* uri = getRequestURI();
+      uri = (uri ? strchr(uri, '?') : nullptr);
+      return uri ? (uri + 1) : nullptr;
+  }
+  const char* getMethod() const {
+    if (m_method.empty()) {
+        dynabuf var(5);
+        GetServerVariable(m_pfc,"HTTP_METHOD",var,5,false);
+        if (!var.empty())
+            m_method = var;
+    }
+    return m_method.c_str();
   }
-  
-  virtual void clearHeader(const string &name) {
-    string hdr = (name=="REMOTE_USER" ? "remote-user" : name) + ":";
-    m_pn->SetHeader(m_pfc, const_cast<char*>(hdr.c_str()), "");
-  }
-  virtual void setHeader(const string &name, const string &value) {
-    string hdr = name + ":";
-    m_pn->SetHeader(m_pfc, const_cast<char*>(hdr.c_str()),
-		    const_cast<char*>(value.c_str()));
-  }
-  virtual string getHeader(const string &name) {
-    string hdr = name + ":";
-    dynabuf buf(1024);
-    GetHeader(m_pn, m_pfc, const_cast<char*>(hdr.c_str()), buf, 1024, false);
-    return string(buf);
-  }
-  virtual void setRemoteUser(const string &user) {
-    setHeader(string("remote-user"), user);
-  }
-  virtual string getRemoteUser(void) {
-    return getHeader(string("remote-user"));
-  }
-  virtual void* sendPage(
-    const string& msg,
-    int code=200,
-    const string& content_type="text/html",
-    const saml::Iterator<header_t>& headers=EMPTY(header_t)) {
-    string hdr = string ("Connection: close\r\nContent-type: ") + content_type + "\r\n";
-    while (headers.hasNext()) {
-        const header_t& h=headers.next();
-        hdr += h.first + ": " + h.second + "\r\n";
+  string getContentType() const {
+    if (m_content_type.empty()) {
+        dynabuf var(32);
+        GetServerVariable(m_pfc,"HTTP_CONTENT_TYPE",var,32,false);
+        if (!var.empty())
+            m_content_type = var;
+    }
+    return m_content_type;
+  }
+  string getRemoteAddr() const {
+    m_remote_addr = AbstractSPRequest::getRemoteAddr();
+    if (m_remote_addr.empty()) {
+        dynabuf var(16);
+        GetServerVariable(m_pfc,"REMOTE_ADDR",var,16,false);
+        if (!var.empty())
+            m_remote_addr = var;
+    }
+    return m_remote_addr;
+  }
+  void log(SPLogLevel level, const string& msg) {
+    AbstractSPRequest::log(level,msg);
+    if (level >= SPCrit)
+        LogEvent(nullptr, EVENTLOG_ERROR_TYPE, 2100, nullptr, msg.c_str());
+  }
+  string makeSafeHeader(const char* rawname) const {
+      string hdr;
+      for (; *rawname; ++rawname) {
+          if (isalnum(*rawname))
+              hdr += *rawname;
+      }
+      return (hdr + ':');
+  }
+  void clearHeader(const char* rawname, const char* cginame) {
+    if (g_checkSpoofing && m_firsttime) {
+        if (m_allhttp.empty())
+	        GetServerVariable(m_pfc, "ALL_HTTP", m_allhttp, 4096);
+        string hdr = g_bSafeHeaderNames ? ("HTTP_" + makeSafeHeader(cginame + 5)) : (string(cginame) + ':');
+        if (strstr(m_allhttp, hdr.c_str()))
+            throw opensaml::SecurityPolicyException("Attempt to spoof header ($1) was detected.", params(1, hdr.c_str()));
+    }
+    if (g_bSafeHeaderNames) {
+        string hdr = makeSafeHeader(rawname);
+        m_pn->SetHeader(m_pfc, const_cast<char*>(hdr.c_str()), const_cast<char*>(g_unsetHeaderValue.c_str()));
     }
+    else if (!strcmp(rawname,"REMOTE_USER")) {
+	    m_pn->SetHeader(m_pfc, "remote-user:", const_cast<char*>(g_unsetHeaderValue.c_str()));
+        m_pn->SetHeader(m_pfc, "remote_user:", const_cast<char*>(g_unsetHeaderValue.c_str()));
+	}
+	else {
+	    string hdr = string(rawname) + ':';
+	    m_pn->SetHeader(m_pfc, const_cast<char*>(hdr.c_str()), const_cast<char*>(g_unsetHeaderValue.c_str()));
+	}
+  }
+  void setHeader(const char* name, const char* value) {
+    string hdr = g_bSafeHeaderNames ? makeSafeHeader(name) : (string(name) + ':');
+    m_pn->SetHeader(m_pfc, const_cast<char*>(hdr.c_str()), const_cast<char*>(value));
+  }
+  string getSecureHeader(const char* name) const {
+    string hdr = g_bSafeHeaderNames ? makeSafeHeader(name) : (string(name) + ':');
+    dynabuf buf(256);
+    GetHeader(m_pn, m_pfc, const_cast<char*>(hdr.c_str()), buf, 256, false);
+    return string(buf.empty() ? "" : buf);
+  }
+  string getHeader(const char* name) const {
+    string hdr(name);
+    hdr += ':';
+    dynabuf buf(256);
+    GetHeader(m_pn, m_pfc, const_cast<char*>(hdr.c_str()), buf, 256, false);
+    return string(buf.empty() ? "" : buf);
+  }
+  void setRemoteUser(const char* user) {
+    setHeader("remote-user", user);
+    if (!user || !*user)
+        m_pfc->pFilterContext = nullptr;
+    else if (m_pfc->pFilterContext = m_pfc->AllocMem(m_pfc, sizeof(char) * (strlen(user) + 1), 0))
+        strcpy(reinterpret_cast<char*>(m_pfc->pFilterContext), user);
+  }
+  string getRemoteUser() const {
+    return getSecureHeader("remote-user");
+  }
+  void setResponseHeader(const char* name, const char* value) {
+    HTTPResponse::setResponseHeader(name, value);
+    // Set for later.
+    if (value)
+        m_headers.insert(make_pair(name,value));
+    else
+        m_headers.erase(name);
+  }
+  long sendResponse(istream& in, long status) {
+    string hdr = string("Connection: close\r\n");
+    for (multimap<string,string>::const_iterator i=m_headers.begin(); i!=m_headers.end(); ++i)
+        hdr += i->first + ": " + i->second + "\r\n";
     hdr += "\r\n";
     const char* codestr="200 OK";
-    switch (code) {
-        case 403:   codestr="403 Forbidden"; break;
-        case 404:   codestr="404 Not Found"; break;
-        case 500:   codestr="500 Server Error"; break;
+    switch (status) {
+        case XMLTOOLING_HTTP_STATUS_NOTMODIFIED:    codestr="304 Not Modified"; break;
+        case XMLTOOLING_HTTP_STATUS_UNAUTHORIZED:   codestr="401 Authorization Required"; break;
+        case XMLTOOLING_HTTP_STATUS_FORBIDDEN:      codestr="403 Forbidden"; break;
+        case XMLTOOLING_HTTP_STATUS_NOTFOUND:       codestr="404 Not Found"; break;
+        case XMLTOOLING_HTTP_STATUS_ERROR:          codestr="500 Server Error"; break;
     }
     m_pfc->ServerSupportFunction(m_pfc, SF_REQ_SEND_RESPONSE_HEADER, (void*)codestr, (DWORD)hdr.c_str(), 0);
-    DWORD resplen = msg.size();
-    m_pfc->WriteClient(m_pfc, (LPVOID)msg.c_str(), &resplen, 0);
-    return (void*)SF_STATUS_REQ_FINISHED;
+    char buf[1024];
+    while (in) {
+        in.read(buf,1024);
+        DWORD resplen = in.gcount();
+        m_pfc->WriteClient(m_pfc, buf, &resplen, 0);
+    }
+    return SF_STATUS_REQ_FINISHED;
   }
-  virtual void* sendRedirect(const string& url) {
-    // XXX: Don't support the httpRedirect option, yet.
-    string hdrs=m_cookie + string("Location: ") + url + "\r\n"
+  long sendRedirect(const char* url) {
+    HTTPResponse::sendRedirect(url);
+    string hdr=string("Location: ") + url + "\r\n"
       "Content-Type: text/html\r\n"
       "Content-Length: 40\r\n"
       "Expires: 01-Jan-1997 12:00:00 GMT\r\n"
-      "Cache-Control: private,no-store,no-cache\r\n\r\n";
-    m_pfc->ServerSupportFunction(m_pfc, SF_REQ_SEND_RESPONSE_HEADER,
-				 "302 Please Wait", (DWORD)hdrs.c_str(), 0);
+      "Cache-Control: private,no-store,no-cache\r\n";
+    for (multimap<string,string>::const_iterator i=m_headers.begin(); i!=m_headers.end(); ++i)
+        hdr += i->first + ": " + i->second + "\r\n";
+    hdr += "\r\n";
+    m_pfc->ServerSupportFunction(m_pfc, SF_REQ_SEND_RESPONSE_HEADER, "302 Please Wait", (DWORD)hdr.c_str(), 0);
     static const char* redmsg="<HTML><BODY>Redirecting...</BODY></HTML>";
     DWORD resplen=40;
     m_pfc->WriteClient(m_pfc, (LPVOID)redmsg, &resplen, 0);
-    return reinterpret_cast<void*>(SF_STATUS_REQ_FINISHED);
+    return SF_STATUS_REQ_FINISHED;
+  }
+  long returnDecline() {
+      return SF_STATUS_REQ_NEXT_NOTIFICATION;
+  }
+  long returnOK() {
+    return SF_STATUS_REQ_NEXT_NOTIFICATION;
   }
-  // XXX: We might not ever hit the 'decline' status in this filter.
-  //virtual void* returnDecline(void) { }
-  virtual void* returnOK(void) { return (void*) SF_STATUS_REQ_NEXT_NOTIFICATION; }
 
-  // The filter never processes the POST, so stub these methods.
-  virtual void setCookie(const string &name, const string &value) {
-    // Set the cookie for later.  Use it during the redirect.
-    m_cookie += "Set-Cookie: " + name + "=" + value + "\r\n";
+  const vector<string>& getClientCertificates() const {
+      return g_NoCerts;
   }
-  virtual const char* getQueryString() const { throw runtime_error("getQueryString not implemented"); }
-  virtual const char* getRequestBody() const { throw runtime_error("getRequestBody not implemented"); }
+
+  // The filter never processes the POST, so stub these methods.
+  long getContentLength() const { throw IOException("The request's Content-Length is not available to an ISAPI filter."); }
+  const char* getRequestBody() const { throw IOException("The request body is not available to an ISAPI filter."); }
 };
 
 DWORD WriteClientError(PHTTP_FILTER_CONTEXT pfc, const char* msg)
 {
-    LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, msg);
+    LogEvent(nullptr, EVENTLOG_ERROR_TYPE, 2100, nullptr, msg);
     static const char* ctype="Connection: close\r\nContent-Type: text/html\r\n\r\n";
     pfc->ServerSupportFunction(pfc,SF_REQ_SEND_RESPONSE_HEADER,"200 OK",(DWORD)ctype,0);
     static const char* xmsg="<HTML><HEAD><TITLE>Shibboleth Filter Error</TITLE></HEAD><BODY>"
@@ -491,10 +615,9 @@ DWORD WriteClientError(PHTTP_FILTER_CONTEXT pfc, const char* msg)
 extern "C" DWORD WINAPI HttpFilterProc(PHTTP_FILTER_CONTEXT pfc, DWORD notificationType, LPVOID pvNotification)
 {
     // Is this a log notification?
-    if (notificationType==SF_NOTIFY_LOG)
-    {
+    if (notificationType==SF_NOTIFY_LOG) {
         if (pfc->pFilterContext)
-            ((PHTTP_FILTER_LOG)pvNotification)->pszClientUserName=static_cast<LPCSTR>(pfc->pFilterContext);
+        	((PHTTP_FILTER_LOG)pvNotification)->pszClientUserName=reinterpret_cast<char*>(pfc->pFilterContext);
         return SF_STATUS_REQ_NEXT_NOTIFICATION;
     }
 
@@ -509,23 +632,25 @@ extern "C" DWORD WINAPI HttpFilterProc(PHTTP_FILTER_CONTEXT pfc, DWORD notificat
         map<string,site_t>::const_iterator map_i=g_Sites.find(static_cast<char*>(buf));
         if (map_i==g_Sites.end())
             return SF_STATUS_REQ_NEXT_NOTIFICATION;
-            
+
         ostringstream threadid;
         threadid << "[" << getpid() << "] isapi_shib" << '\0';
-        saml::NDC ndc(threadid.str().c_str());
+        xmltooling::NDC ndc(threadid.str().c_str());
 
         ShibTargetIsapiF stf(pfc, pn, map_i->second);
 
         // "false" because we don't override the Shib settings
-        pair<bool,void*> res = stf.doCheckAuthN();
-        if (res.first) return (DWORD)res.second;
+        pair<bool,long> res = stf.getServiceProvider().doAuthentication(stf);
+        if (!g_spoofKey.empty())
+            pn->SetHeader(pfc, "ShibSpoofCheck:", const_cast<char*>(g_spoofKey.c_str()));
+        if (res.first) return res.second;
 
         // "false" because we don't override the Shib settings
-        res = stf.doExportAssertions();
-        if (res.first) return (DWORD)res.second;
+        res = stf.getServiceProvider().doExport(stf);
+        if (res.first) return res.second;
 
-        res = stf.doCheckAuthZ();
-        if (res.first) return (DWORD)res.second;
+        res = stf.getServiceProvider().doAuthorization(stf);
+        if (res.first) return res.second;
 
         return SF_STATUS_REQ_NEXT_NOTIFICATION;
     }
@@ -538,26 +663,27 @@ extern "C" DWORD WINAPI HttpFilterProc(PHTTP_FILTER_CONTEXT pfc, DWORD notificat
         else
             return WriteClientError(pfc,"Shibboleth Filter detected unexpected IIS error.");
     }
-    catch (saml::SAMLException& e) {
-        LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, e.what());
+    catch (exception& e) {
+        LogEvent(nullptr, EVENTLOG_ERROR_TYPE, 2100, nullptr, e.what());
         return WriteClientError(pfc,"Shibboleth Filter caught an exception, check Event Log for details.");
     }
-#ifndef _DEBUG
     catch(...) {
-        return WriteClientError(pfc,"Shibboleth Filter caught an unknown exception.");
+        LogEvent(nullptr, EVENTLOG_ERROR_TYPE, 2100, nullptr, "Shibboleth Filter threw an unknown exception.");
+        if (g_catchAll)
+            return WriteClientError(pfc,"Shibboleth Filter threw an unknown exception.");
+        throw;
     }
-#endif
 
     return WriteClientError(pfc,"Shibboleth Filter reached unreachable code, save my walrus!");
 }
-        
+
 
 /****************************************************************************/
 // ISAPI Extension
 
 DWORD WriteClientError(LPEXTENSION_CONTROL_BLOCK lpECB, const char* msg)
 {
-    LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, msg);
+    LogEvent(nullptr, EVENTLOG_ERROR_TYPE, 2100, nullptr, msg);
     static const char* ctype="Connection: close\r\nContent-Type: text/html\r\n\r\n";
     lpECB->ServerSupportFunction(lpECB->ConnID,HSE_REQ_SEND_RESPONSE_HEADER,"200 OK",0,(LPDWORD)ctype);
     static const char* xmsg="<HTML><HEAD><TITLE>Shibboleth Error</TITLE></HEAD><BODY><H1>Shibboleth Error</H1>";
@@ -572,19 +698,29 @@ DWORD WriteClientError(LPEXTENSION_CONTROL_BLOCK lpECB, const char* msg)
 }
 
 
-class ShibTargetIsapiE : public ShibTarget
+class ShibTargetIsapiE : public AbstractSPRequest
 {
   LPEXTENSION_CONTROL_BLOCK m_lpECB;
-  string m_cookie;
+  multimap<string,string> m_headers;
+  mutable vector<string> m_certs;
   mutable string m_body;
   mutable bool m_gotBody;
-  
+  int m_port;
+  string m_scheme,m_hostname,m_uri;
+  mutable string m_remote_addr,m_remote_user;
+
 public:
-  ShibTargetIsapiE(LPEXTENSION_CONTROL_BLOCK lpECB, const site_t& site) : m_gotBody(false) {
+  ShibTargetIsapiE(LPEXTENSION_CONTROL_BLOCK lpECB, const site_t& site)
+      : AbstractSPRequest(SHIBSP_LOGCAT".ISAPI"), m_lpECB(lpECB), m_gotBody(false) {
     dynabuf ssl(5);
     GetServerVariable(lpECB,"HTTPS",ssl,5);
     bool SSL=(ssl=="on" || ssl=="ON");
 
+    // Scheme may come from site def or be derived from IIS.
+    m_scheme=site.m_scheme;
+    if (m_scheme.empty() || !g_bNormalizeRequest)
+        m_scheme = SSL ? "https" : "http";
+
     // URL path always come from IIS.
     dynabuf url(256);
     GetServerVariable(lpECB,"URL",url,255);
@@ -601,165 +737,244 @@ public:
         strncpy(port,site.m_port.c_str(),10);
         static_cast<char*>(port)[10]=0;
     }
+    m_port = atoi(port);
 
-    // Scheme may come from site def or be derived from IIS.
-    const char* scheme=site.m_scheme.c_str();
-    if (!scheme || !*scheme || !g_bNormalizeRequest) {
-        scheme = SSL ? "https" : "http";
-    }
-
-    // Get the other server variables.
-    dynabuf remote_addr(16),hostname(32);
-    GetServerVariable(lpECB, "REMOTE_ADDR", remote_addr, 16);
-    GetServerVariable(lpECB, "SERVER_NAME", hostname, 32);
+    dynabuf var(32);
+    GetServerVariable(lpECB, "SERVER_NAME", var, 32);
 
     // Make sure SERVER_NAME is "authorized" for use on this site. If not, set to canonical name.
-    const char* host=hostname;
-    if (site.m_name!=host && site.m_aliases.find(host)==site.m_aliases.end())
-        host=site.m_name.c_str();
+    m_hostname=var;
+    if (site.m_name!=m_hostname && site.m_aliases.find(m_hostname)==site.m_aliases.end())
+        m_hostname=site.m_name;
 
     /*
      * IIS screws us over on PATH_INFO (the hits keep on coming). We need to figure out if
      * the server is set up for proper PATH_INFO handling, or "IIS sucks rabid weasels mode",
      * which is the default. No perfect way to tell, but we can take a good guess by checking
      * whether the URL is a substring of the PATH_INFO:
-     * 
+     *
      * e.g. for /Shibboleth.sso/SAML/POST
-     * 
+     *
      *  Bad mode (default):
      *      URL:        /Shibboleth.sso
      *      PathInfo:   /Shibboleth.sso/SAML/POST
-     * 
+     *
      *  Good mode:
      *      URL:        /Shibboleth.sso
      *      PathInfo:   /SAML/POST
      */
-    
-    string fullurl;
-    
+
+    string uri;
+
     // Clearly we're only in bad mode if path info exists at all.
     if (lpECB->lpszPathInfo && *(lpECB->lpszPathInfo)) {
         if (strstr(lpECB->lpszPathInfo,url))
             // Pretty good chance we're in bad mode, unless the PathInfo repeats the path itself.
-            fullurl=lpECB->lpszPathInfo;
+            uri = lpECB->lpszPathInfo;
         else {
-            fullurl+=url;
-            fullurl+=lpECB->lpszPathInfo;
+            uri = url;
+            uri += lpECB->lpszPathInfo;
         }
     }
-    
+    else {
+        uri = url;
+    }
+
     // For consistency with Apache, let's add the query string.
     if (lpECB->lpszQueryString && *(lpECB->lpszQueryString)) {
-        fullurl+='?';
-        fullurl+=lpECB->lpszQueryString;
+        uri += '?';
+        uri += lpECB->lpszQueryString;
     }
-    init(scheme, host, atoi(port), fullurl.c_str(), lpECB->lpszContentType, remote_addr, lpECB->lpszMethod);
 
-    m_lpECB = lpECB;
+    setRequestURI(uri.c_str());
   }
   ~ShibTargetIsapiE() { }
 
-  virtual void log(ShibLogLevel level, const string &msg) {
-      ShibTarget::log(level,msg);
-      if (level == LogLevelError)
-          LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, msg.c_str());
+  const char* getScheme() const {
+    return m_scheme.c_str();
+  }
+  const char* getHostname() const {
+    return m_hostname.c_str();
   }
-  virtual string getCookies() const {
+  int getPort() const {
+    return m_port;
+  }
+  const char* getMethod() const {
+    return m_lpECB->lpszMethod;
+  }
+  string getContentType() const {
+    return m_lpECB->lpszContentType ? m_lpECB->lpszContentType : "";
+  }
+  long getContentLength() const {
+      return m_lpECB->cbTotalBytes;
+  }
+  string getRemoteUser() const {
+    if (m_remote_user.empty()) {
+        dynabuf var(16);
+        GetServerVariable(m_lpECB, "REMOTE_USER", var, 32, false);
+        if (!var.empty())
+            m_remote_user = var;
+    }
+    return m_remote_user;
+  }
+  string getRemoteAddr() const {
+    m_remote_addr = AbstractSPRequest::getRemoteAddr();
+    if (m_remote_addr.empty()) {
+        dynabuf var(16);
+        GetServerVariable(m_lpECB, "REMOTE_ADDR", var, 16, false);
+        if (!var.empty())
+            m_remote_addr = var;
+    }
+    return m_remote_addr;
+  }
+  void log(SPLogLevel level, const string& msg) const {
+      AbstractSPRequest::log(level,msg);
+      if (level >= SPCrit)
+          LogEvent(nullptr, EVENTLOG_ERROR_TYPE, 2100, nullptr, msg.c_str());
+  }
+  string getHeader(const char* name) const {
+    string hdr("HTTP_");
+    for (; *name; ++name) {
+        if (*name=='-')
+            hdr += '_';
+        else
+            hdr += toupper(*name);
+    }
     dynabuf buf(128);
-    GetServerVariable(m_lpECB, "HTTP_COOKIE", buf, 128, false);
+    GetServerVariable(m_lpECB, const_cast<char*>(hdr.c_str()), buf, 128, false);
     return buf.empty() ? "" : buf;
   }
-  virtual void setCookie(const string &name, const string &value) {
-    // Set the cookie for later.  Use it during the redirect.
-    m_cookie += "Set-Cookie: " + name + "=" + value + "\r\n";
+  void setResponseHeader(const char* name, const char* value) {
+    HTTPResponse::setResponseHeader(name, value);
+    // Set for later.
+    if (value)
+        m_headers.insert(make_pair(name,value));
+    else
+        m_headers.erase(name);
   }
-  virtual const char* getQueryString() const {
+  const char* getQueryString() const {
     return m_lpECB->lpszQueryString;
   }
-  virtual const char* getRequestBody() const {
+  const char* getRequestBody() const {
     if (m_gotBody)
         return m_body.c_str();
     if (m_lpECB->cbTotalBytes > 1024*1024) // 1MB?
-        throw saml::SAMLException("Size of POST request body exceeded limit.");
-    else if (m_lpECB->cbTotalBytes != m_lpECB->cbAvailable) {
+        throw opensaml::SecurityPolicyException("Size of request body exceeded 1M size limit.");
+    else if (m_lpECB->cbTotalBytes > m_lpECB->cbAvailable) {
       m_gotBody=true;
-      char buf[8192];
       DWORD datalen=m_lpECB->cbTotalBytes;
+      if (m_lpECB->cbAvailable > 0) {
+        m_body.assign(reinterpret_cast<char*>(m_lpECB->lpbData),m_lpECB->cbAvailable);
+        datalen-=m_lpECB->cbAvailable;
+      }
+      char buf[8192];
       while (datalen) {
         DWORD buflen=8192;
         BOOL ret = m_lpECB->ReadClient(m_lpECB->ConnID, buf, &buflen);
-        if (!ret || !buflen)
-            throw saml::SAMLException("Error reading POST request body from browser.");
+        if (!ret) {
+            char message[65];
+            _snprintf(message, 64, "Error reading request body from browser (%x).", GetLastError());
+            throw IOException(message);
+        }
+        else if (!buflen)
+            throw IOException("Socket closed while reading request body from browser.");
         m_body.append(buf, buflen);
         datalen-=buflen;
       }
     }
-    else {
+    else if (m_lpECB->cbAvailable) {
         m_gotBody=true;
         m_body.assign(reinterpret_cast<char*>(m_lpECB->lpbData),m_lpECB->cbAvailable);
     }
     return m_body.c_str();
   }
-  virtual void* sendPage(
-    const string &msg,
-    int code=200,
-    const string& content_type="text/html",
-    const saml::Iterator<header_t>& headers=EMPTY(header_t)) {
-    string hdr = string ("Connection: close\r\nContent-type: ") + content_type + "\r\n";
-    for (unsigned int k = 0; k < headers.size(); k++) {
-      hdr += headers[k].first + ": " + headers[k].second + "\r\n";
-    }
+  long sendResponse(istream& in, long status) {
+    string hdr = string("Connection: close\r\n");
+    for (multimap<string,string>::const_iterator i=m_headers.begin(); i!=m_headers.end(); ++i)
+        hdr += i->first + ": " + i->second + "\r\n";
     hdr += "\r\n";
     const char* codestr="200 OK";
-    switch (code) {
-        case 403:   codestr="403 Forbidden"; break;
-        case 404:   codestr="404 Not Found"; break;
-        case 500:   codestr="500 Server Error"; break;
+    switch (status) {
+        case XMLTOOLING_HTTP_STATUS_NOTMODIFIED:    codestr="304 Not Modified"; break;
+        case XMLTOOLING_HTTP_STATUS_UNAUTHORIZED:   codestr="401 Authorization Required"; break;
+        case XMLTOOLING_HTTP_STATUS_FORBIDDEN:      codestr="403 Forbidden"; break;
+        case XMLTOOLING_HTTP_STATUS_NOTFOUND:       codestr="404 Not Found"; break;
+        case XMLTOOLING_HTTP_STATUS_ERROR:          codestr="500 Server Error"; break;
     }
     m_lpECB->ServerSupportFunction(m_lpECB->ConnID, HSE_REQ_SEND_RESPONSE_HEADER, (void*)codestr, 0, (LPDWORD)hdr.c_str());
-    DWORD resplen = msg.size();
-    m_lpECB->WriteClient(m_lpECB->ConnID, (LPVOID)msg.c_str(), &resplen, HSE_IO_SYNC);
-    return (void*)HSE_STATUS_SUCCESS;
+    char buf[1024];
+    while (in) {
+        in.read(buf,1024);
+        DWORD resplen = in.gcount();
+        m_lpECB->WriteClient(m_lpECB->ConnID, buf, &resplen, HSE_IO_SYNC);
+    }
+    return HSE_STATUS_SUCCESS;
   }
-  virtual void* sendRedirect(const string& url) {
-    // XXX: Don't support the httpRedirect option, yet.
-    string hdrs = m_cookie + "Location: " + url + "\r\n"
+  long sendRedirect(const char* url) {
+    HTTPResponse::sendRedirect(url);
+    string hdr=string("Location: ") + url + "\r\n"
       "Content-Type: text/html\r\n"
       "Content-Length: 40\r\n"
       "Expires: 01-Jan-1997 12:00:00 GMT\r\n"
-      "Cache-Control: private,no-store,no-cache\r\n\r\n";
-    m_lpECB->ServerSupportFunction(m_lpECB->ConnID, HSE_REQ_SEND_RESPONSE_HEADER,
-				 "302 Moved", 0, (LPDWORD)hdrs.c_str());
+      "Cache-Control: private,no-store,no-cache\r\n";
+    for (multimap<string,string>::const_iterator i=m_headers.begin(); i!=m_headers.end(); ++i)
+        hdr += i->first + ": " + i->second + "\r\n";
+    hdr += "\r\n";
+    m_lpECB->ServerSupportFunction(m_lpECB->ConnID, HSE_REQ_SEND_RESPONSE_HEADER, "302 Moved", 0, (LPDWORD)hdr.c_str());
     static const char* redmsg="<HTML><BODY>Redirecting...</BODY></HTML>";
     DWORD resplen=40;
     m_lpECB->WriteClient(m_lpECB->ConnID, (LPVOID)redmsg, &resplen, HSE_IO_SYNC);
-    return (void*)HSE_STATUS_SUCCESS;
+    return HSE_STATUS_SUCCESS;
   }
   // Decline happens in the POST processor if this isn't the shire url
   // Note that it can also happen with HTAccess, but we don't support that, yet.
-  virtual void* returnDecline(void) {
-    return (void*)
-      WriteClientError(m_lpECB, "ISAPI extension can only be invoked to process Shibboleth protocol requests."
-		       "Make sure the mapped file extension doesn't match actual content.");
+  long returnDecline() {
+    return WriteClientError(
+        m_lpECB,
+        "ISAPI extension can only be invoked to process Shibboleth protocol requests."
+		"Make sure the mapped file extension doesn't match actual content."
+        );
+  }
+  long returnOK() {
+      return HSE_STATUS_SUCCESS;
+  }
+
+  const vector<string>& getClientCertificates() const {
+      if (m_certs.empty()) {
+        char CertificateBuf[8192];
+        CERT_CONTEXT_EX ccex;
+        ccex.cbAllocated = sizeof(CertificateBuf);
+        ccex.CertContext.pbCertEncoded = (BYTE*)CertificateBuf;
+        DWORD dwSize = sizeof(ccex);
+
+        if (m_lpECB->ServerSupportFunction(m_lpECB->ConnID, HSE_REQ_GET_CERT_INFO_EX, (LPVOID)&ccex, (LPDWORD)dwSize, nullptr)) {
+            if (ccex.CertContext.cbCertEncoded) {
+                xsecsize_t outlen;
+                XMLByte* serialized = Base64::encode(reinterpret_cast<XMLByte*>(CertificateBuf), ccex.CertContext.cbCertEncoded, &outlen);
+                m_certs.push_back(reinterpret_cast<char*>(serialized));
+#ifdef SHIBSP_XERCESC_HAS_XMLBYTE_RELEASE
+                XMLString::release(&serialized);
+#else
+                XMLString::release((char**)&serialized);
+#endif
+            }
+        }
+      }
+      return m_certs;
   }
-  virtual void* returnOK(void) { return (void*) HSE_STATUS_SUCCESS; }
 
   // Not used in the extension.
-  virtual void clearHeader(const string &name) { throw runtime_error("clearHeader not implemented"); }
-  virtual void setHeader(const string &name, const string &value) { throw runtime_error("setHeader not implemented"); }
-  virtual string getHeader(const string &name) { throw runtime_error("getHeader not implemented"); }
-  virtual void setRemoteUser(const string &user) { throw runtime_error("setRemoteUser not implemented"); }
-  virtual string getRemoteUser(void) { throw runtime_error("getRemoteUser not implemented"); }
+  void clearHeader(const char* rawname, const char* cginame) { throw runtime_error("clearHeader not implemented"); }
+  void setHeader(const char* name, const char* value) { throw runtime_error("setHeader not implemented"); }
+  void setRemoteUser(const char* user) { throw runtime_error("setRemoteUser not implemented"); }
 };
 
 extern "C" DWORD WINAPI HttpExtensionProc(LPEXTENSION_CONTROL_BLOCK lpECB)
 {
-    string targeturl;
-    const IApplication* application=NULL;
     try {
         ostringstream threadid;
         threadid << "[" << getpid() << "] isapi_shib_extension" << '\0';
-        saml::NDC ndc(threadid.str().c_str());
+        xmltooling::NDC ndc(threadid.str().c_str());
 
         // Determine web site number. This can't really fail, I don't think.
         dynabuf buf(128);
@@ -768,12 +983,12 @@ extern "C" DWORD WINAPI HttpExtensionProc(LPEXTENSION_CONTROL_BLOCK lpECB)
         // Match site instance to host name, skip if no match.
         map<string,site_t>::const_iterator map_i=g_Sites.find(static_cast<char*>(buf));
         if (map_i==g_Sites.end())
-            return WriteClientError(lpECB, "Shibboleth Extension not configured for this web site.");
+            return WriteClientError(lpECB, "Shibboleth Extension not configured for web site (check ISAPI mappings in SP configuration).");
 
         ShibTargetIsapiE ste(lpECB, map_i->second);
-        pair<bool,void*> res = ste.doHandler();
-        if (res.first) return (DWORD)res.second;
-        
+        pair<bool,long> res = ste.getServiceProvider().doHandler(ste);
+        if (res.first) return res.second;
+
         return WriteClientError(lpECB, "Shibboleth Extension failed to process request");
 
     }
@@ -786,15 +1001,16 @@ extern "C" DWORD WINAPI HttpExtensionProc(LPEXTENSION_CONTROL_BLOCK lpECB)
         else
             return WriteClientError(lpECB,"Server detected unexpected IIS error.");
     }
-    catch (saml::SAMLException& e) {
-        LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, e.what());
+    catch (exception& e) {
+        LogEvent(nullptr, EVENTLOG_ERROR_TYPE, 2100, nullptr, e.what());
         return WriteClientError(lpECB,"Shibboleth Extension caught an exception, check Event Log for details.");
     }
-#ifndef _DEBUG
     catch(...) {
-        return WriteClientError(lpECB,"Shibboleth Extension caught an unknown exception.");
+        LogEvent(nullptr, EVENTLOG_ERROR_TYPE, 2100, nullptr, "Shibboleth Extension threw an unknown exception.");
+        if (g_catchAll)
+            return WriteClientError(lpECB,"Shibboleth Extension threw an unknown exception.");
+        throw;
     }
-#endif
 
     // If we get here we've got an error.
     return HSE_STATUS_ERROR;