X-Git-Url: http://www.project-moonshot.org/gitweb/?a=blobdiff_plain;f=isapi_shib%2Fisapi_shib.cpp;h=4dac1a79528f42e98894c7bc9fc7e6550969fcfc;hb=c9c1b385ed3e2926097cb06f75b971e659cd2e4d;hp=d14c932536ece100186a2868d7108646bafdeada;hpb=893153531f13cba410524ec5f32955eaa2f98bfd;p=shibboleth%2Fsp.git diff --git a/isapi_shib/isapi_shib.cpp b/isapi_shib/isapi_shib.cpp index d14c932..4dac1a7 100644 --- a/isapi_shib/isapi_shib.cpp +++ b/isapi_shib/isapi_shib.cpp @@ -20,6 +20,7 @@ * Shibboleth ISAPI filter */ +#define SHIBSP_LITE #include "config_win32.h" #define _CRT_NONSTDC_NO_DEPRECATE 1 @@ -27,29 +28,38 @@ #include #include +#include +#include +#include #include +#include +#include +#include +#include -#include - +#include #include #include #include +#include #include #include using namespace shibsp; using namespace xmltooling; +using namespace xercesc; using namespace std; // globals namespace { + static const XMLCh path[] = UNICODE_LITERAL_4(p,a,t,h); + static const XMLCh validate[] = UNICODE_LITERAL_8(v,a,l,i,d,a,t,e); static const XMLCh name[] = UNICODE_LITERAL_4(n,a,m,e); static const XMLCh port[] = UNICODE_LITERAL_4(p,o,r,t); static const XMLCh sslport[] = UNICODE_LITERAL_7(s,s,l,p,o,r,t); static const XMLCh scheme[] = UNICODE_LITERAL_6(s,c,h,e,m,e); static const XMLCh id[] = UNICODE_LITERAL_2(i,d); - static const XMLCh Implementation[] = UNICODE_LITERAL_14(I,m,p,l,e,m,e,n,t,a,t,i,o,n); static const XMLCh ISAPI[] = UNICODE_LITERAL_5(I,S,A,P,I); static const XMLCh Alias[] = UNICODE_LITERAL_5(A,l,i,a,s); static const XMLCh normalizeRequest[] = UNICODE_LITERAL_16(n,o,r,m,a,l,i,z,e,R,e,q,u,e,s,t); @@ -78,11 +88,20 @@ namespace { string m_scheme,m_port,m_sslport,m_name; set m_aliases; }; + + struct context_t { + char* m_user; + bool m_checked; + }; HINSTANCE g_hinstDLL; - shibtarget::ShibTargetConfig* g_Config = NULL; + SPConfig* g_Config = NULL; map g_Sites; bool g_bNormalizeRequest = true; + string g_unsetHeaderValue; + bool g_checkSpoofing = true; + bool g_catchAll = false; + vector g_NoCerts; } BOOL LogEvent( @@ -137,65 +156,72 @@ extern "C" BOOL WINAPI GetFilterVersion(PHTTP_FILTER_VERSION pVer) return TRUE; } -#ifndef _DEBUG - try - { -#endif - LPCSTR schemadir=getenv("SHIBSCHEMAS"); - if (!schemadir) - schemadir=SHIB_SCHEMAS; - LPCSTR config=getenv("SHIBCONFIG"); - if (!config) - config=SHIB_CONFIG; - g_Config=&shibtarget::ShibTargetConfig::getConfig(); - SPConfig::getConfig().setFeatures( - SPConfig::Listener | - SPConfig::Caching | - SPConfig::Metadata | - SPConfig::AAP | - SPConfig::RequestMapping | - SPConfig::InProcess | - SPConfig::Logging - ); - if (!g_Config->init(schemadir)) { - g_Config=NULL; - LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, - "Filter startup failed during library initialization, check native log for help."); - return FALSE; - } - else if (!g_Config->load(config)) { - g_Config=NULL; - LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, - "Filter startup failed to load configuration, check native log for help."); - return FALSE; - } - - // Access the implementation-specifics for site mappings. - ServiceProvider* conf=SPConfig::getConfig().getServiceProvider(); - xmltooling::Locker locker(conf); - const PropertySet* props=conf->getPropertySet("Local"); + g_Config=&SPConfig::getConfig(); + g_Config->setFeatures( + SPConfig::Listener | + SPConfig::Caching | + SPConfig::RequestMapping | + SPConfig::InProcess | + SPConfig::Logging | + SPConfig::Handlers + ); + if (!g_Config->init()) { + g_Config=NULL; + LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, + "Filter startup failed during library initialization, check native log for help."); + return FALSE; + } + + LPCSTR config=getenv("SHIBSP_CONFIG"); + if (!config) + config=SHIBSP_CONFIG; + + try { + DOMDocument* dummydoc=XMLToolingConfig::getConfig().getParser().newDocument(); + XercesJanitor docjanitor(dummydoc); + DOMElement* dummy = dummydoc->createElementNS(NULL,path); + auto_ptr_XMLCh src(config); + dummy->setAttributeNS(NULL,path,src.get()); + dummy->setAttributeNS(NULL,validate,xmlconstants::XML_ONE); + + g_Config->setServiceProvider(g_Config->ServiceProviderManager.newPlugin(XML_SERVICE_PROVIDER,dummy)); + g_Config->getServiceProvider()->init(); + } + catch (exception& ex) { + g_Config->term(); + g_Config=NULL; + LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, ex.what()); + LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, + "Filter startup failed to load configuration, check native log for details."); + return FALSE; + } + + // Access implementation-specifics and site mappings. + ServiceProvider* sp=g_Config->getServiceProvider(); + Locker locker(sp); + const PropertySet* props=sp->getPropertySet("InProcess"); + if (props) { + pair unsetValue=props->getString("unsetHeaderValue"); + if (unsetValue.first) + g_unsetHeaderValue = unsetValue.second; + pair flag=props->getBool("checkSpoofing"); + g_checkSpoofing = !flag.first || flag.second; + flag=props->getBool("catchAll"); + g_catchAll = flag.first && flag.second; + + props = props->getPropertySet("ISAPI"); if (props) { - const DOMElement* impl=XMLHelper::getFirstChildElement(props->getElement(),Implementation); - if (impl && (impl=XMLHelper::getFirstChildElement(impl,ISAPI))) { - const XMLCh* flag=impl->getAttributeNS(NULL,normalizeRequest); - g_bNormalizeRequest=(!flag || !*flag || *flag==chDigit_1 || *flag==chLatin_t); - impl=XMLHelper::getFirstChildElement(impl,Site); - while (impl) { - auto_ptr_char id(impl->getAttributeNS(NULL,id)); - if (id.get()) - g_Sites.insert(pair(id.get(),site_t(impl))); - impl=XMLHelper::getNextSiblingElement(impl,Site); - } + flag = props->getBool("normalizeRequest"); + g_bNormalizeRequest = !flag.first || flag.second; + const DOMElement* child = XMLHelper::getFirstChildElement(props->getElement(),Site); + while (child) { + auto_ptr_char id(child->getAttributeNS(NULL,id)); + if (id.get()) + g_Sites.insert(pair(id.get(),site_t(child))); + child=XMLHelper::getNextSiblingElement(child,Site); } } -#ifndef _DEBUG - } - catch (...) - { - LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, "Filter startup failed with an exception."); - return FALSE; } -#endif pVer->dwFilterVersion=HTTP_FILTER_REVISION; strncpy(pVer->lpszFilterDesc,"Shibboleth ISAPI Filter",SF_MAX_FILTER_DESC_LEN); @@ -211,7 +237,7 @@ extern "C" BOOL WINAPI GetFilterVersion(PHTTP_FILTER_VERSION pVer) extern "C" BOOL WINAPI TerminateFilter(DWORD) { if (g_Config) - g_Config->shutdown(); + g_Config->term(); g_Config = NULL; LogEvent(NULL, EVENTLOG_INFORMATION_TYPE, 7701, NULL, "Filter shut down..."); return TRUE; @@ -329,22 +355,20 @@ class ShibTargetIsapiF : public AbstractSPRequest { PHTTP_FILTER_CONTEXT m_pfc; PHTTP_FILTER_PREPROC_HEADERS m_pn; - map m_headers; - vector m_certs; + multimap m_headers; int m_port; - string m_scheme,m_hostname,m_uri; + string m_scheme,m_hostname; mutable string m_remote_addr,m_content_type,m_method; + dynabuf m_allhttp; public: - ShibTargetIsapiF(PHTTP_FILTER_CONTEXT pfc, PHTTP_FILTER_PREPROC_HEADERS pn, const site_t& site) { - - m_pfc = pfc; - m_pn = pn; + ShibTargetIsapiF(PHTTP_FILTER_CONTEXT pfc, PHTTP_FILTER_PREPROC_HEADERS pn, const site_t& site) + : AbstractSPRequest(SHIBSP_LOGCAT".ISAPI"), m_pfc(pfc), m_pn(pn), m_allhttp(4096) { // URL path always come from IIS. dynabuf var(256); GetHeader(pn,pfc,"url",var,256,false); - m_uri = var; + setRequestURI(var); // Port may come from IIS or from site def. if (!g_bNormalizeRequest || (pfc->fIsSecurePort && site.m_sslport.empty()) || (!pfc->fIsSecurePort && site.m_port.empty())) { @@ -369,6 +393,14 @@ public: m_hostname = var; if (site.m_name!=m_hostname && site.m_aliases.find(m_hostname)==site.m_aliases.end()) m_hostname=site.m_name; + + if (!pfc->pFilterContext) { + pfc->pFilterContext = pfc->AllocMem(pfc, sizeof(context_t), NULL); + if (static_cast(pfc->pFilterContext)) { + static_cast(pfc->pFilterContext)->m_user = NULL; + static_cast(pfc->pFilterContext)->m_checked = false; + } + } } ~ShibTargetIsapiF() { } @@ -381,9 +413,6 @@ public: int getPort() const { return m_port; } - const char* getRequestURI() const { - return m_uri.c_str(); - } const char* getMethod() const { if (m_method.empty()) { dynabuf var(5); @@ -419,10 +448,16 @@ public: if (level >= SPError) LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, msg.c_str()); } - void clearHeader(const char* name) { - string hdr(!strcmp(name,"REMOTE_USER") ? "remote-user" : name); + void clearHeader(const char* rawname, const char* cginame) { + if (g_checkSpoofing && m_pfc->pFilterContext && !static_cast(m_pfc->pFilterContext)->m_checked) { + if (m_allhttp.empty()) + GetServerVariable(m_pfc,"ALL_HTTP",m_allhttp,4096); + if (strstr(m_allhttp, cginame)) + throw opensaml::SecurityPolicyException("Attempt to spoof header ($1) was detected.", params(1, rawname)); + } + string hdr(!strcmp(rawname,"REMOTE_USER") ? "remote-user" : rawname); hdr += ':'; - m_pn->SetHeader(m_pfc, const_cast(hdr.c_str()), ""); + m_pn->SetHeader(m_pfc, const_cast(hdr.c_str()), const_cast(g_unsetHeaderValue.c_str())); } void setHeader(const char* name, const char* value) { string hdr(name); @@ -432,12 +467,18 @@ public: string getHeader(const char* name) const { string hdr(name); hdr += ':'; - dynabuf buf(1024); - GetHeader(m_pn, m_pfc, const_cast(hdr.c_str()), buf, 1024, false); + dynabuf buf(256); + GetHeader(m_pn, m_pfc, const_cast(hdr.c_str()), buf, 256, false); return string(buf); } void setRemoteUser(const char* user) { setHeader("remote-user", user); + if (m_pfc->pFilterContext) { + if (!user || !*user) + static_cast(m_pfc->pFilterContext)->m_user = NULL; + else if (static_cast(m_pfc->pFilterContext)->m_user = (char*)m_pfc->AllocMem(m_pfc, sizeof(char) * (strlen(user) + 1), NULL)) + strcpy(static_cast(m_pfc->pFilterContext)->m_user, user); + } } string getRemoteUser() const { return getHeader("remote-user"); @@ -445,20 +486,21 @@ public: void setResponseHeader(const char* name, const char* value) { // Set for later. if (value) - m_headers[name] = value; + m_headers.insert(make_pair(name,value)); else m_headers.erase(name); } long sendResponse(istream& in, long status) { string hdr = string("Connection: close\r\n"); - for (map::const_iterator i=m_headers.begin(); i!=m_headers.end(); ++i) + for (multimap::const_iterator i=m_headers.begin(); i!=m_headers.end(); ++i) hdr += i->first + ": " + i->second + "\r\n"; hdr += "\r\n"; const char* codestr="200 OK"; switch (status) { - case SAML_HTTP_STATUS_FORBIDDEN:codestr="403 Forbidden"; break; - case SAML_HTTP_STATUS_NOTFOUND: codestr="404 Not Found"; break; - case SAML_HTTP_STATUS_ERROR: codestr="500 Server Error"; break; + case XMLTOOLING_HTTP_STATUS_UNAUTHORIZED: codestr="401 Authorization Required"; break; + case XMLTOOLING_HTTP_STATUS_FORBIDDEN: codestr="403 Forbidden"; break; + case XMLTOOLING_HTTP_STATUS_NOTFOUND: codestr="404 Not Found"; break; + case XMLTOOLING_HTTP_STATUS_ERROR: codestr="500 Server Error"; break; } m_pfc->ServerSupportFunction(m_pfc, SF_REQ_SEND_RESPONSE_HEADER, (void*)codestr, (DWORD)hdr.c_str(), 0); char buf[1024]; @@ -476,7 +518,7 @@ public: "Content-Length: 40\r\n" "Expires: 01-Jan-1997 12:00:00 GMT\r\n" "Cache-Control: private,no-store,no-cache\r\n"; - for (map::const_iterator i=m_headers.begin(); i!=m_headers.end(); ++i) + for (multimap::const_iterator i=m_headers.begin(); i!=m_headers.end(); ++i) hdr += i->first + ": " + i->second + "\r\n"; hdr += "\r\n"; m_pfc->ServerSupportFunction(m_pfc, SF_REQ_SEND_RESPONSE_HEADER, "302 Please Wait", (DWORD)hdr.c_str(), 0); @@ -492,13 +534,13 @@ public: return SF_STATUS_REQ_NEXT_NOTIFICATION; } - const vector& getClientCertificates() const { - return m_certs; + const vector& getClientCertificates() const { + return g_NoCerts; } // The filter never processes the POST, so stub these methods. - const char* getQueryString() const { throw runtime_error("getQueryString not implemented"); } - const char* getRequestBody() const { throw runtime_error("getRequestBody not implemented"); } + const char* getQueryString() const { throw IOException("getQueryString not implemented"); } + const char* getRequestBody() const { throw IOException("getRequestBody not implemented"); } }; DWORD WriteClientError(PHTTP_FILTER_CONTEXT pfc, const char* msg) @@ -521,10 +563,9 @@ DWORD WriteClientError(PHTTP_FILTER_CONTEXT pfc, const char* msg) extern "C" DWORD WINAPI HttpFilterProc(PHTTP_FILTER_CONTEXT pfc, DWORD notificationType, LPVOID pvNotification) { // Is this a log notification? - if (notificationType==SF_NOTIFY_LOG) - { - if (pfc->pFilterContext) - ((PHTTP_FILTER_LOG)pvNotification)->pszClientUserName=static_cast(pfc->pFilterContext); + if (notificationType==SF_NOTIFY_LOG) { + if (pfc->pFilterContext && static_cast(pfc->pFilterContext)->m_user) + ((PHTTP_FILTER_LOG)pvNotification)->pszClientUserName=static_cast(pfc->pFilterContext)->m_user; return SF_STATUS_REQ_NEXT_NOTIFICATION; } @@ -548,6 +589,8 @@ extern "C" DWORD WINAPI HttpFilterProc(PHTTP_FILTER_CONTEXT pfc, DWORD notificat // "false" because we don't override the Shib settings pair res = stf.getServiceProvider().doAuthentication(stf); + if (pfc->pFilterContext) + static_cast(pfc->pFilterContext)->m_checked = true; if (res.first) return res.second; // "false" because we don't override the Shib settings @@ -572,11 +615,12 @@ extern "C" DWORD WINAPI HttpFilterProc(PHTTP_FILTER_CONTEXT pfc, DWORD notificat LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, e.what()); return WriteClientError(pfc,"Shibboleth Filter caught an exception, check Event Log for details."); } -#ifndef _DEBUG catch(...) { - return WriteClientError(pfc,"Shibboleth Filter caught an unknown exception."); + LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, "Shibboleth Filter threw an unknown exception."); + if (g_catchAll) + return WriteClientError(pfc,"Shibboleth Filter threw an unknown exception."); + throw; } -#endif return WriteClientError(pfc,"Shibboleth Filter reached unreachable code, save my walrus!"); } @@ -605,16 +649,17 @@ DWORD WriteClientError(LPEXTENSION_CONTROL_BLOCK lpECB, const char* msg) class ShibTargetIsapiE : public AbstractSPRequest { LPEXTENSION_CONTROL_BLOCK m_lpECB; - map m_headers; - vector m_certs; + multimap m_headers; + mutable vector m_certs; mutable string m_body; mutable bool m_gotBody; int m_port; string m_scheme,m_hostname,m_uri; - mutable string m_remote_addr; + mutable string m_remote_addr,m_remote_user; public: - ShibTargetIsapiE(LPEXTENSION_CONTROL_BLOCK lpECB, const site_t& site) : m_lpECB(lpECB), m_gotBody(false) { + ShibTargetIsapiE(LPEXTENSION_CONTROL_BLOCK lpECB, const site_t& site) + : AbstractSPRequest(SHIBSP_LOGCAT".ISAPI"), m_lpECB(lpECB), m_gotBody(false) { dynabuf ssl(5); GetServerVariable(lpECB,"HTTPS",ssl,5); bool SSL=(ssl=="on" || ssl=="ON"); @@ -667,22 +712,29 @@ public: * PathInfo: /SAML/POST */ + string uri; + // Clearly we're only in bad mode if path info exists at all. if (lpECB->lpszPathInfo && *(lpECB->lpszPathInfo)) { if (strstr(lpECB->lpszPathInfo,url)) // Pretty good chance we're in bad mode, unless the PathInfo repeats the path itself. - m_uri = lpECB->lpszPathInfo; + uri = lpECB->lpszPathInfo; else { - m_uri = url; - m_uri += lpECB->lpszPathInfo; + uri = url; + uri += lpECB->lpszPathInfo; } } + else { + uri = url; + } // For consistency with Apache, let's add the query string. if (lpECB->lpszQueryString && *(lpECB->lpszQueryString)) { - m_uri += '?'; - m_uri += lpECB->lpszQueryString; + uri += '?'; + uri += lpECB->lpszQueryString; } + + setRequestURI(uri.c_str()); } ~ShibTargetIsapiE() { } @@ -695,9 +747,6 @@ public: int getPort() const { return m_port; } - const char* getRequestURI() const { - return m_uri.c_str(); - } const char* getMethod() const { return m_lpECB->lpszMethod; } @@ -707,6 +756,15 @@ public: long getContentLength() const { return m_lpECB->cbTotalBytes; } + string getRemoteUser() const { + if (m_remote_user.empty()) { + dynabuf var(16); + GetServerVariable(m_lpECB, "REMOTE_USER", var, 32, false); + if (!var.empty()) + m_remote_user = var; + } + return m_remote_user; + } string getRemoteAddr() const { if (m_remote_addr.empty()) { dynabuf var(16); @@ -716,7 +774,7 @@ public: } return m_remote_addr; } - void log(SPLogLevel level, const string& msg) { + void log(SPLogLevel level, const string& msg) const { AbstractSPRequest::log(level,msg); if (level >= SPError) LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, msg.c_str()); @@ -736,7 +794,7 @@ public: void setResponseHeader(const char* name, const char* value) { // Set for later. if (value) - m_headers[name] = value; + m_headers.insert(make_pair(name,value)); else m_headers.erase(name); } @@ -747,8 +805,8 @@ public: if (m_gotBody) return m_body.c_str(); if (m_lpECB->cbTotalBytes > 1024*1024) // 1MB? - throw opensaml::BindingException("Size of POST request body exceeded limit."); - else if (m_lpECB->cbTotalBytes != m_lpECB->cbAvailable) { + throw opensaml::SecurityPolicyException("Size of request body exceeded 1M size limit."); + else if (m_lpECB->cbTotalBytes > m_lpECB->cbAvailable) { m_gotBody=true; char buf[8192]; DWORD datalen=m_lpECB->cbTotalBytes; @@ -756,12 +814,12 @@ public: DWORD buflen=8192; BOOL ret = m_lpECB->ReadClient(m_lpECB->ConnID, buf, &buflen); if (!ret || !buflen) - throw saml::SAMLException("Error reading POST request body from browser."); + throw IOException("Error reading request body from browser."); m_body.append(buf, buflen); datalen-=buflen; } } - else { + else if (m_lpECB->cbAvailable) { m_gotBody=true; m_body.assign(reinterpret_cast(m_lpECB->lpbData),m_lpECB->cbAvailable); } @@ -769,14 +827,15 @@ public: } long sendResponse(istream& in, long status) { string hdr = string("Connection: close\r\n"); - for (map::const_iterator i=m_headers.begin(); i!=m_headers.end(); ++i) + for (multimap::const_iterator i=m_headers.begin(); i!=m_headers.end(); ++i) hdr += i->first + ": " + i->second + "\r\n"; hdr += "\r\n"; const char* codestr="200 OK"; switch (status) { - case SAML_HTTP_STATUS_FORBIDDEN:codestr="403 Forbidden"; break; - case SAML_HTTP_STATUS_NOTFOUND: codestr="404 Not Found"; break; - case SAML_HTTP_STATUS_ERROR: codestr="500 Server Error"; break; + case XMLTOOLING_HTTP_STATUS_UNAUTHORIZED: codestr="401 Authorization Required"; break; + case XMLTOOLING_HTTP_STATUS_FORBIDDEN: codestr="403 Forbidden"; break; + case XMLTOOLING_HTTP_STATUS_NOTFOUND: codestr="404 Not Found"; break; + case XMLTOOLING_HTTP_STATUS_ERROR: codestr="500 Server Error"; break; } m_lpECB->ServerSupportFunction(m_lpECB->ConnID, HSE_REQ_SEND_RESPONSE_HEADER, (void*)codestr, 0, (LPDWORD)hdr.c_str()); char buf[1024]; @@ -793,7 +852,7 @@ public: "Content-Length: 40\r\n" "Expires: 01-Jan-1997 12:00:00 GMT\r\n" "Cache-Control: private,no-store,no-cache\r\n"; - for (map::const_iterator i=m_headers.begin(); i!=m_headers.end(); ++i) + for (multimap::const_iterator i=m_headers.begin(); i!=m_headers.end(); ++i) hdr += i->first + ": " + i->second + "\r\n"; hdr += "\r\n"; m_lpECB->ServerSupportFunction(m_lpECB->ConnID, HSE_REQ_SEND_RESPONSE_HEADER, "302 Moved", 0, (LPDWORD)hdr.c_str()); @@ -815,15 +874,30 @@ public: return HSE_STATUS_SUCCESS; } - const vector& getClientCertificates() const { + const vector& getClientCertificates() const { + if (m_certs.empty()) { + char CertificateBuf[8192]; + CERT_CONTEXT_EX ccex; + ccex.cbAllocated = sizeof(CertificateBuf); + ccex.CertContext.pbCertEncoded = (BYTE*)CertificateBuf; + DWORD dwSize = sizeof(ccex); + + if (m_lpECB->ServerSupportFunction(m_lpECB->ConnID, HSE_REQ_GET_CERT_INFO_EX, (LPVOID)&ccex, (LPDWORD)dwSize, NULL)) { + if (ccex.CertContext.cbCertEncoded) { + unsigned int outlen; + XMLByte* serialized = Base64::encode(reinterpret_cast(CertificateBuf), ccex.CertContext.cbCertEncoded, &outlen); + m_certs.push_back(reinterpret_cast(serialized)); + XMLString::release(&serialized); + } + } + } return m_certs; } // Not used in the extension. - virtual void clearHeader(const char* name) { throw runtime_error("clearHeader not implemented"); } - virtual void setHeader(const char* name, const char* value) { throw runtime_error("setHeader not implemented"); } - virtual void setRemoteUser(const char* user) { throw runtime_error("setRemoteUser not implemented"); } - virtual string getRemoteUser() const { throw runtime_error("getRemoteUser not implemented"); } + void clearHeader(const char* rawname, const char* cginame) { throw runtime_error("clearHeader not implemented"); } + void setHeader(const char* name, const char* value) { throw runtime_error("setHeader not implemented"); } + void setRemoteUser(const char* user) { throw runtime_error("setRemoteUser not implemented"); } }; extern "C" DWORD WINAPI HttpExtensionProc(LPEXTENSION_CONTROL_BLOCK lpECB) @@ -840,7 +914,7 @@ extern "C" DWORD WINAPI HttpExtensionProc(LPEXTENSION_CONTROL_BLOCK lpECB) // Match site instance to host name, skip if no match. map::const_iterator map_i=g_Sites.find(static_cast(buf)); if (map_i==g_Sites.end()) - return WriteClientError(lpECB, "Shibboleth Extension not configured for this web site."); + return WriteClientError(lpECB, "Shibboleth Extension not configured for web site (check mappings in configuration)."); ShibTargetIsapiE ste(lpECB, map_i->second); pair res = ste.getServiceProvider().doHandler(ste); @@ -862,11 +936,12 @@ extern "C" DWORD WINAPI HttpExtensionProc(LPEXTENSION_CONTROL_BLOCK lpECB) LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, e.what()); return WriteClientError(lpECB,"Shibboleth Extension caught an exception, check Event Log for details."); } -#ifndef _DEBUG catch(...) { - return WriteClientError(lpECB,"Shibboleth Extension caught an unknown exception."); + LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, "Shibboleth Extension threw an unknown exception."); + if (g_catchAll) + return WriteClientError(lpECB,"Shibboleth Extension threw an unknown exception."); + throw; } -#endif // If we get here we've got an error. return HSE_STATUS_ERROR;