X-Git-Url: http://www.project-moonshot.org/gitweb/?a=blobdiff_plain;f=isapi_shib%2Fisapi_shib.cpp;h=bff7387bb08078065b10ac0c1f96c23f25e72e24;hb=87f8c5b1383ce267075073f2184f282450e16e09;hp=1881ff81e439d7dc8bb838ec0499eb892dd33343;hpb=a86ab1b9b44b78f028f9183595213868326695d5;p=shibboleth%2Fsp.git diff --git a/isapi_shib/isapi_shib.cpp b/isapi_shib/isapi_shib.cpp index 1881ff8..bff7387 100644 --- a/isapi_shib/isapi_shib.cpp +++ b/isapi_shib/isapi_shib.cpp @@ -1,98 +1,69 @@ /* - * The Shibboleth License, Version 1. - * Copyright (c) 2002 - * University Corporation for Advanced Internet Development, Inc. - * All rights reserved + * Copyright 2001-2007 Internet2 + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * + * http://www.apache.org/licenses/LICENSE-2.0 * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions are met: - * - * Redistributions of source code must retain the above copyright notice, this - * list of conditions and the following disclaimer. - * - * Redistributions in binary form must reproduce the above copyright notice, - * this list of conditions and the following disclaimer in the documentation - * and/or other materials provided with the distribution, if any, must include - * the following acknowledgment: "This product includes software developed by - * the University Corporation for Advanced Internet Development - * Internet2 Project. Alternately, this acknowledegement - * may appear in the software itself, if and wherever such third-party - * acknowledgments normally appear. - * - * Neither the name of Shibboleth nor the names of its contributors, nor - * Internet2, nor the University Corporation for Advanced Internet Development, - * Inc., nor UCAID may be used to endorse or promote products derived from this - * software without specific prior written permission. For written permission, - * please contact shibboleth@shibboleth.org - * - * Products derived from this software may not be called Shibboleth, Internet2, - * UCAID, or the University Corporation for Advanced Internet Development, nor - * may Shibboleth appear in their name, without prior written permission of the - * University Corporation for Advanced Internet Development. - * - * - * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" - * AND WITH ALL FAULTS. ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT - * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A - * PARTICULAR PURPOSE, AND NON-INFRINGEMENT ARE DISCLAIMED AND THE ENTIRE RISK - * OF SATISFACTORY QUALITY, PERFORMANCE, ACCURACY, AND EFFORT IS WITH LICENSEE. - * IN NO EVENT SHALL THE COPYRIGHT OWNER, CONTRIBUTORS OR THE UNIVERSITY - * CORPORATION FOR ADVANCED INTERNET DEVELOPMENT, INC. BE LIABLE FOR ANY DIRECT, - * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES - * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; - * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND - * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT - * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS - * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. */ -/* isapi_shib.cpp - Shibboleth ISAPI filter - - Scott Cantor - 8/23/02 -*/ +/** + * isapi_shib.cpp + * + * Shibboleth ISAPI filter + */ +#define SHIBSP_LITE #include "config_win32.h" -// SAML Runtime -#include -#include -#include -#include - -#include - -#include -#include +#define _CRT_NONSTDC_NO_DEPRECATE 1 +#define _CRT_SECURE_NO_DEPRECATE 1 + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#include #include -#include +#include +#include +#include #include #include +using namespace shibsp; +using namespace xmltooling; +using namespace xercesc; using namespace std; -using namespace log4cpp; -using namespace saml; -using namespace shibboleth; -using namespace shibtarget; // globals namespace { - static const XMLCh name[] = { chLatin_n, chLatin_a, chLatin_m, chLatin_e, chNull }; - static const XMLCh port[] = { chLatin_p, chLatin_o, chLatin_r, chLatin_t, chNull }; - static const XMLCh sslport[] = { chLatin_s, chLatin_s, chLatin_l, chLatin_p, chLatin_o, chLatin_r, chLatin_t, chNull }; - static const XMLCh scheme[] = { chLatin_s, chLatin_c, chLatin_h, chLatin_e, chLatin_m, chLatin_e, chNull }; - static const XMLCh id[] = { chLatin_i, chLatin_d, chNull }; - static const XMLCh Implementation[] = - { chLatin_I, chLatin_m, chLatin_p, chLatin_l, chLatin_e, chLatin_m, chLatin_e, chLatin_n, chLatin_t, chLatin_a, chLatin_t, chLatin_i, chLatin_o, chLatin_n, chNull }; - static const XMLCh ISAPI[] = { chLatin_I, chLatin_S, chLatin_A, chLatin_P, chLatin_I, chNull }; - static const XMLCh Alias[] = { chLatin_A, chLatin_l, chLatin_i, chLatin_a, chLatin_s, chNull }; - static const XMLCh normalizeRequest[] = - { chLatin_n, chLatin_o, chLatin_r, chLatin_m, chLatin_a, chLatin_l, chLatin_i, chLatin_z, chLatin_e, - chLatin_R, chLatin_e, chLatin_q, chLatin_u, chLatin_e, chLatin_s, chLatin_t, chNull - }; - static const XMLCh Site[] = { chLatin_S, chLatin_i, chLatin_t, chLatin_e, chNull }; + static const XMLCh path[] = UNICODE_LITERAL_4(p,a,t,h); + static const XMLCh validate[] = UNICODE_LITERAL_8(v,a,l,i,d,a,t,e); + static const XMLCh name[] = UNICODE_LITERAL_4(n,a,m,e); + static const XMLCh port[] = UNICODE_LITERAL_4(p,o,r,t); + static const XMLCh sslport[] = UNICODE_LITERAL_7(s,s,l,p,o,r,t); + static const XMLCh scheme[] = UNICODE_LITERAL_6(s,c,h,e,m,e); + static const XMLCh id[] = UNICODE_LITERAL_2(i,d); + static const XMLCh ISAPI[] = UNICODE_LITERAL_5(I,S,A,P,I); + static const XMLCh Alias[] = UNICODE_LITERAL_5(A,l,i,a,s); + static const XMLCh normalizeRequest[] = UNICODE_LITERAL_16(n,o,r,m,a,l,i,z,e,R,e,q,u,e,s,t); + static const XMLCh Site[] = UNICODE_LITERAL_4(S,i,t,e); struct site_t { site_t(const DOMElement* e) @@ -105,12 +76,13 @@ namespace { if (s.get()) m_scheme=s.get(); if (p.get()) m_port=p.get(); if (p2.get()) m_sslport=p2.get(); - DOMNodeList* nlist=e->getElementsByTagNameNS(ShibTargetConfig::SHIBTARGET_NS,Alias); - for (int i=0; nlist && igetLength(); i++) { - if (nlist->item(i)->hasChildNodes()) { - auto_ptr_char alias(nlist->item(i)->getFirstChild()->getNodeValue()); + e = XMLHelper::getFirstChildElement(e, Alias); + while (e) { + if (e->hasChildNodes()) { + auto_ptr_char alias(e->getFirstChild()->getNodeValue()); m_aliases.insert(alias.get()); } + e = XMLHelper::getNextSiblingElement(e, Alias); } } string m_scheme,m_port,m_sslport,m_name; @@ -118,9 +90,13 @@ namespace { }; HINSTANCE g_hinstDLL; - ShibTargetConfig* g_Config = NULL; + SPConfig* g_Config = NULL; map g_Sites; bool g_bNormalizeRequest = true; + string g_unsetHeaderValue; + bool g_checkSpoofing = true; + bool g_catchAll = false; + vector g_NoCerts; } BOOL LogEvent( @@ -149,8 +125,7 @@ extern "C" BOOL WINAPI GetExtensionVersion(HSE_VERSION_INFO* pVer) if (!pVer) return FALSE; - if (!g_Config) - { + if (!g_Config) { LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, "Extension mode startup not possible, is the DLL loaded as a filter?"); return FALSE; @@ -176,60 +151,72 @@ extern "C" BOOL WINAPI GetFilterVersion(PHTTP_FILTER_VERSION pVer) return TRUE; } -#ifndef _DEBUG - try - { -#endif - LPCSTR schemadir=getenv("SHIBSCHEMAS"); - if (!schemadir) - schemadir=SHIB_SCHEMAS; - LPCSTR config=getenv("SHIBCONFIG"); - if (!config) - config=SHIB_CONFIG; - g_Config=&ShibTargetConfig::getConfig(); - g_Config->setFeatures( - ShibTargetConfig::Listener | - ShibTargetConfig::Metadata | - ShibTargetConfig::AAP | - ShibTargetConfig::RequestMapper | - ShibTargetConfig::LocalExtensions | - ShibTargetConfig::Logging - ); - if (!g_Config->init(schemadir,config)) { - g_Config=NULL; - LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, - "Filter startup failed during initialization, check shire log for help."); - return FALSE; - } - - // Access the implementation-specifics for site mappings. - IConfig* conf=g_Config->getINI(); - Locker locker(conf); - const IPropertySet* props=conf->getPropertySet("Local"); + g_Config=&SPConfig::getConfig(); + g_Config->setFeatures( + SPConfig::Listener | + SPConfig::Caching | + SPConfig::RequestMapping | + SPConfig::InProcess | + SPConfig::Logging | + SPConfig::Handlers + ); + if (!g_Config->init()) { + g_Config=NULL; + LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, + "Filter startup failed during library initialization, check native log for help."); + return FALSE; + } + + LPCSTR config=getenv("SHIBSP_CONFIG"); + if (!config) + config=SHIBSP_CONFIG; + + try { + DOMDocument* dummydoc=XMLToolingConfig::getConfig().getParser().newDocument(); + XercesJanitor docjanitor(dummydoc); + DOMElement* dummy = dummydoc->createElementNS(NULL,path); + auto_ptr_XMLCh src(config); + dummy->setAttributeNS(NULL,path,src.get()); + dummy->setAttributeNS(NULL,validate,xmlconstants::XML_ONE); + + g_Config->setServiceProvider(g_Config->ServiceProviderManager.newPlugin(XML_SERVICE_PROVIDER,dummy)); + g_Config->getServiceProvider()->init(); + } + catch (exception& ex) { + g_Config->term(); + g_Config=NULL; + LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, ex.what()); + LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, + "Filter startup failed to load configuration, check native log for details."); + return FALSE; + } + + // Access implementation-specifics and site mappings. + ServiceProvider* sp=g_Config->getServiceProvider(); + Locker locker(sp); + const PropertySet* props=sp->getPropertySet("InProcess"); + if (props) { + pair unsetValue=props->getString("unsetHeaderValue"); + if (unsetValue.first) + g_unsetHeaderValue = unsetValue.second; + pair flag=props->getBool("checkSpoofing"); + g_checkSpoofing = !flag.first || flag.second; + flag=props->getBool("catchAll"); + g_catchAll = flag.first && flag.second; + + props = props->getPropertySet("ISAPI"); if (props) { - const DOMElement* impl=saml::XML::getFirstChildElement( - props->getElement(),ShibTargetConfig::SHIBTARGET_NS,Implementation - ); - if (impl && (impl=saml::XML::getFirstChildElement(impl,ShibTargetConfig::SHIBTARGET_NS,ISAPI))) { - const XMLCh* flag=impl->getAttributeNS(NULL,normalizeRequest); - g_bNormalizeRequest=(!flag || !*flag || *flag==chDigit_1 || *flag==chLatin_t); - impl=saml::XML::getFirstChildElement(impl,ShibTargetConfig::SHIBTARGET_NS,Site); - while (impl) { - auto_ptr_char id(impl->getAttributeNS(NULL,id)); - if (id.get()) - g_Sites.insert(pair(id.get(),site_t(impl))); - impl=saml::XML::getNextSiblingElement(impl,ShibTargetConfig::SHIBTARGET_NS,Site); - } + flag = props->getBool("normalizeRequest"); + g_bNormalizeRequest = !flag.first || flag.second; + const DOMElement* child = XMLHelper::getFirstChildElement(props->getElement(),Site); + while (child) { + auto_ptr_char id(child->getAttributeNS(NULL,id)); + if (id.get()) + g_Sites.insert(pair(id.get(),site_t(child))); + child=XMLHelper::getNextSiblingElement(child,Site); } } -#ifndef _DEBUG } - catch (...) - { - LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, "Filter startup failed with an exception."); - return FALSE; - } -#endif pVer->dwFilterVersion=HTTP_FILTER_REVISION; strncpy(pVer->lpszFilterDesc,"Shibboleth ISAPI Filter",SF_MAX_FILTER_DESC_LEN); @@ -245,7 +232,7 @@ extern "C" BOOL WINAPI GetFilterVersion(PHTTP_FILTER_VERSION pVer) extern "C" BOOL WINAPI TerminateFilter(DWORD) { if (g_Config) - g_Config->shutdown(); + g_Config->term(); g_Config = NULL; LogEvent(NULL, EVENTLOG_INFORMATION_TYPE, 7701, NULL, "Filter shut down..."); return TRUE; @@ -302,14 +289,12 @@ bool dynabuf::operator==(const char* s) const } void GetServerVariable(PHTTP_FILTER_CONTEXT pfc, LPSTR lpszVariable, dynabuf& s, DWORD size=80, bool bRequired=true) - throw (bad_alloc, DWORD) { s.reserve(size); s.erase(); size=s.size(); - while (!pfc->GetServerVariable(pfc,lpszVariable,s,&size)) - { + while (!pfc->GetServerVariable(pfc,lpszVariable,s,&size)) { // Grumble. Check the error. DWORD e=GetLastError(); if (e==ERROR_INSUFFICIENT_BUFFER) @@ -322,14 +307,12 @@ void GetServerVariable(PHTTP_FILTER_CONTEXT pfc, LPSTR lpszVariable, dynabuf& s, } void GetServerVariable(LPEXTENSION_CONTROL_BLOCK lpECB, LPSTR lpszVariable, dynabuf& s, DWORD size=80, bool bRequired=true) - throw (bad_alloc, DWORD) { s.reserve(size); s.erase(); size=s.size(); - while (!lpECB->GetServerVariable(lpECB->ConnID,lpszVariable,s,&size)) - { + while (!lpECB->GetServerVariable(lpECB->ConnID,lpszVariable,s,&size)) { // Grumble. Check the error. DWORD e=GetLastError(); if (e==ERROR_INSUFFICIENT_BUFFER) @@ -343,14 +326,12 @@ void GetServerVariable(LPEXTENSION_CONTROL_BLOCK lpECB, LPSTR lpszVariable, dyna void GetHeader(PHTTP_FILTER_PREPROC_HEADERS pn, PHTTP_FILTER_CONTEXT pfc, LPSTR lpszName, dynabuf& s, DWORD size=80, bool bRequired=true) - throw (bad_alloc, DWORD) { s.reserve(size); s.erase(); size=s.size(); - while (!pn->GetHeader(pfc,lpszName,s,&size)) - { + while (!pn->GetHeader(pfc,lpszName,s,&size)) { // Grumble. Check the error. DWORD e=GetLastError(); if (e==ERROR_INSUFFICIENT_BUFFER) @@ -365,142 +346,182 @@ void GetHeader(PHTTP_FILTER_PREPROC_HEADERS pn, PHTTP_FILTER_CONTEXT pfc, /****************************************************************************/ // ISAPI Filter -class ShibTargetIsapiF : public ShibTarget +class ShibTargetIsapiF : public AbstractSPRequest { PHTTP_FILTER_CONTEXT m_pfc; PHTTP_FILTER_PREPROC_HEADERS m_pn; - string m_cookie; - Category* m_log; + multimap m_headers; + int m_port; + string m_scheme,m_hostname; + mutable string m_remote_addr,m_content_type,m_method; + dynabuf m_allhttp; + public: ShibTargetIsapiF(PHTTP_FILTER_CONTEXT pfc, PHTTP_FILTER_PREPROC_HEADERS pn, const site_t& site) - : m_log(&Category::getInstance("isapi_shib")) - { + : AbstractSPRequest(SHIBSP_LOGCAT".ISAPI"), m_pfc(pfc), m_pn(pn), m_allhttp(4096) { // URL path always come from IIS. - dynabuf url(256); - GetHeader(pn,pfc,"url",url,256,false); + dynabuf var(256); + GetHeader(pn,pfc,"url",var,256,false); + setRequestURI(var); // Port may come from IIS or from site def. - dynabuf port(11); - if (!g_bNormalizeRequest || (pfc->fIsSecurePort && site.m_sslport.empty()) || (!pfc->fIsSecurePort && site.m_port.empty())) - GetServerVariable(pfc,"SERVER_PORT",port,10); + if (!g_bNormalizeRequest || (pfc->fIsSecurePort && site.m_sslport.empty()) || (!pfc->fIsSecurePort && site.m_port.empty())) { + GetServerVariable(pfc,"SERVER_PORT",var,10); + m_port = atoi(var); + } else if (pfc->fIsSecurePort) { - strncpy(port,site.m_sslport.c_str(),10); - static_cast(port)[10]=0; + m_port = atoi(site.m_sslport.c_str()); } else { - strncpy(port,site.m_port.c_str(),10); - static_cast(port)[10]=0; + m_port = atoi(site.m_port.c_str()); } // Scheme may come from site def or be derived from IIS. - const char* scheme=site.m_scheme.c_str(); - if (!scheme || !*scheme || !g_bNormalizeRequest) - scheme=pfc->fIsSecurePort ? "https" : "http"; + m_scheme=site.m_scheme; + if (m_scheme.empty() || !g_bNormalizeRequest) + m_scheme=pfc->fIsSecurePort ? "https" : "http"; - // Get the rest of the server variables. - dynabuf remote_addr(16),method(5),content_type(32),hostname(32); - GetServerVariable(pfc,"SERVER_NAME",hostname,32); - GetServerVariable(pfc,"REMOTE_ADDR",remote_addr,16); - GetServerVariable(pfc,"REQUEST_METHOD",method,5,false); - GetServerVariable(pfc,"CONTENT_TYPE",content_type,32,false); + GetServerVariable(pfc,"SERVER_NAME",var,32); // Make sure SERVER_NAME is "authorized" for use on this site. If not, set to canonical name. - const char* host=hostname; - if (site.m_name!=host && site.m_aliases.find(host)==site.m_aliases.end()) - host=site.m_name.c_str(); - - init(g_Config, scheme, host, atoi(port), url, content_type, remote_addr, method); - - m_pfc = pfc; - m_pn = pn; + m_hostname = var; + if (site.m_name!=m_hostname && site.m_aliases.find(m_hostname)==site.m_aliases.end()) + m_hostname=site.m_name; } ~ShibTargetIsapiF() { } - virtual void log(ShibLogLevel level, const string &msg) { - if (level == LogLevelError) - LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, msg.c_str()); - m_log->log( - (level == LogLevelDebug ? Priority::DEBUG : - (level == LogLevelInfo ? Priority::INFO : - (level == LogLevelWarn ? Priority::WARN : Priority::ERROR))), - msg - ); + const char* getScheme() const { + return m_scheme.c_str(); } - virtual string getCookies() const { - dynabuf buf(128); - GetHeader(m_pn, m_pfc, "Cookie:", buf, 128, false); - return buf.empty() ? "" : buf; + const char* getHostname() const { + return m_hostname.c_str(); } - - virtual void clearHeader(const string &name) { - string hdr = name + ":"; - m_pn->SetHeader(m_pfc, const_cast(hdr.c_str()), ""); + int getPort() const { + return m_port; + } + const char* getMethod() const { + if (m_method.empty()) { + dynabuf var(5); + GetServerVariable(m_pfc,"REQUEST_METHOD",var,5,false); + if (!var.empty()) + m_method = var; + } + return m_method.c_str(); + } + string getContentType() const { + if (m_content_type.empty()) { + dynabuf var(32); + GetServerVariable(m_pfc,"CONTENT_TYPE",var,32,false); + if (!var.empty()) + m_content_type = var; + } + return m_content_type; + } + long getContentLength() const { + return 0; + } + string getRemoteAddr() const { + if (m_remote_addr.empty()) { + dynabuf var(16); + GetServerVariable(m_pfc,"REMOTE_ADDR",var,16,false); + if (!var.empty()) + m_remote_addr = var; + } + return m_remote_addr; } - virtual void setHeader(const string &name, const string &value) { - string hdr = name + ":"; - m_pn->SetHeader(m_pfc, const_cast(hdr.c_str()), - const_cast(value.c_str())); + void log(SPLogLevel level, const string& msg) { + AbstractSPRequest::log(level,msg); + if (level >= SPError) + LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, msg.c_str()); } - virtual string getHeader(const string &name) { - string hdr = name + ":"; - dynabuf buf(1024); - GetHeader(m_pn, m_pfc, const_cast(hdr.c_str()), buf, 1024, false); + void clearHeader(const char* rawname, const char* cginame) { + if (g_checkSpoofing) { + if (m_allhttp.empty()) + GetServerVariable(m_pfc,"ALL_HTTP",m_allhttp,4096); + if (strstr(m_allhttp, cginame)) + throw opensaml::SecurityPolicyException("Attempt to spoof header ($1) was detected.", params(1, rawname)); + } + string hdr(!strcmp(rawname,"REMOTE_USER") ? "remote-user" : rawname); + hdr += ':'; + m_pn->SetHeader(m_pfc, const_cast(hdr.c_str()), const_cast(g_unsetHeaderValue.c_str())); + } + void setHeader(const char* name, const char* value) { + string hdr(name); + hdr += ':'; + m_pn->SetHeader(m_pfc, const_cast(hdr.c_str()), const_cast(value)); + } + string getHeader(const char* name) const { + string hdr(name); + hdr += ':'; + dynabuf buf(256); + GetHeader(m_pn, m_pfc, const_cast(hdr.c_str()), buf, 256, false); return string(buf); } - virtual void setRemoteUser(const string &user) { - setHeader(string("remote-user"), user); + void setRemoteUser(const char* user) { + setHeader("remote-user", user); } - virtual string getRemoteUser(void) { - return getHeader(string("remote-user")); + string getRemoteUser() const { + return getHeader("remote-user"); } - virtual void* sendPage( - const string& msg, - int code=200, - const string& content_type="text/html", - const Iterator& headers=EMPTY(header_t)) { - string hdr = string ("Connection: close\r\nContent-type: ") + content_type + "\r\n"; - while (headers.hasNext()) { - const header_t& h=headers.next(); - hdr += h.first + ": " + h.second + "\r\n"; - } + void setResponseHeader(const char* name, const char* value) { + // Set for later. + if (value) + m_headers.insert(make_pair(name,value)); + else + m_headers.erase(name); + } + long sendResponse(istream& in, long status) { + string hdr = string("Connection: close\r\n"); + for (multimap::const_iterator i=m_headers.begin(); i!=m_headers.end(); ++i) + hdr += i->first + ": " + i->second + "\r\n"; hdr += "\r\n"; const char* codestr="200 OK"; - switch (code) { - case 403: codestr="403 Forbidden"; break; - case 404: codestr="404 Not Found"; break; - case 500: codestr="500 Server Error"; break; + switch (status) { + case XMLTOOLING_HTTP_STATUS_UNAUTHORIZED: codestr="401 Authorization Required"; break; + case XMLTOOLING_HTTP_STATUS_FORBIDDEN: codestr="403 Forbidden"; break; + case XMLTOOLING_HTTP_STATUS_NOTFOUND: codestr="404 Not Found"; break; + case XMLTOOLING_HTTP_STATUS_ERROR: codestr="500 Server Error"; break; } m_pfc->ServerSupportFunction(m_pfc, SF_REQ_SEND_RESPONSE_HEADER, (void*)codestr, (DWORD)hdr.c_str(), 0); - DWORD resplen = msg.size(); - m_pfc->WriteClient(m_pfc, (LPVOID)msg.c_str(), &resplen, 0); - return (void*)SF_STATUS_REQ_FINISHED; + char buf[1024]; + while (in) { + in.read(buf,1024); + DWORD resplen = in.gcount(); + m_pfc->WriteClient(m_pfc, buf, &resplen, 0); + } + return SF_STATUS_REQ_FINISHED; } - virtual void* sendRedirect(const string& url) { + long sendRedirect(const char* url) { // XXX: Don't support the httpRedirect option, yet. - string hdrs=m_cookie + string("Location: ") + url + "\r\n" + string hdr=string("Location: ") + url + "\r\n" "Content-Type: text/html\r\n" "Content-Length: 40\r\n" "Expires: 01-Jan-1997 12:00:00 GMT\r\n" - "Cache-Control: private,no-store,no-cache\r\n\r\n"; - m_pfc->ServerSupportFunction(m_pfc, SF_REQ_SEND_RESPONSE_HEADER, - "302 Please Wait", (DWORD)hdrs.c_str(), 0); + "Cache-Control: private,no-store,no-cache\r\n"; + for (multimap::const_iterator i=m_headers.begin(); i!=m_headers.end(); ++i) + hdr += i->first + ": " + i->second + "\r\n"; + hdr += "\r\n"; + m_pfc->ServerSupportFunction(m_pfc, SF_REQ_SEND_RESPONSE_HEADER, "302 Please Wait", (DWORD)hdr.c_str(), 0); static const char* redmsg="Redirecting..."; DWORD resplen=40; m_pfc->WriteClient(m_pfc, (LPVOID)redmsg, &resplen, 0); - return reinterpret_cast(SF_STATUS_REQ_FINISHED); + return SF_STATUS_REQ_FINISHED; + } + long returnDecline() { + return SF_STATUS_REQ_NEXT_NOTIFICATION; + } + long returnOK() { + return SF_STATUS_REQ_NEXT_NOTIFICATION; } - // XXX: We might not ever hit the 'decline' status in this filter. - //virtual void* returnDecline(void) { } - virtual void* returnOK(void) { return (void*) SF_STATUS_REQ_NEXT_NOTIFICATION; } - // The filter never processes the POST, so stub these methods. - virtual void setCookie(const string &name, const string &value) { - // Set the cookie for later. Use it during the redirect. - m_cookie += "Set-Cookie: " + name + "=" + value + "\r\n"; + const vector& getClientCertificates() const { + return g_NoCerts; } - virtual string getArgs(void) { throw runtime_error("getArgs not implemented"); } - virtual string getPostData(void) { throw runtime_error("getPostData not implemented"); } + + // The filter never processes the POST, so stub these methods. + const char* getQueryString() const { throw IOException("getQueryString not implemented"); } + const char* getRequestBody() const { throw IOException("getRequestBody not implemented"); } }; DWORD WriteClientError(PHTTP_FILTER_CONTEXT pfc, const char* msg) @@ -544,20 +565,20 @@ extern "C" DWORD WINAPI HttpFilterProc(PHTTP_FILTER_CONTEXT pfc, DWORD notificat ostringstream threadid; threadid << "[" << getpid() << "] isapi_shib" << '\0'; - saml::NDC ndc(threadid.str().c_str()); + xmltooling::NDC ndc(threadid.str().c_str()); ShibTargetIsapiF stf(pfc, pn, map_i->second); // "false" because we don't override the Shib settings - pair res = stf.doCheckAuthN(); - if (res.first) return (DWORD)res.second; + pair res = stf.getServiceProvider().doAuthentication(stf); + if (res.first) return res.second; // "false" because we don't override the Shib settings - res = stf.doExportAssertions(); - if (res.first) return (DWORD)res.second; + res = stf.getServiceProvider().doExport(stf); + if (res.first) return res.second; - res = stf.doCheckAuthZ(); - if (res.first) return (DWORD)res.second; + res = stf.getServiceProvider().doAuthorization(stf); + if (res.first) return res.second; return SF_STATUS_REQ_NEXT_NOTIFICATION; } @@ -568,461 +589,22 @@ extern "C" DWORD WINAPI HttpFilterProc(PHTTP_FILTER_CONTEXT pfc, DWORD notificat if (e==ERROR_NO_DATA) return WriteClientError(pfc,"A required variable or header was empty."); else - return WriteClientError(pfc,"Server detected unexpected IIS error."); - } -#ifndef _DEBUG - catch(...) { - return WriteClientError(pfc,"Server caught an unknown exception."); - } -#endif - - return WriteClientError(pfc,"Server reached unreachable code, save my walrus!"); -} - - -#if 0 -IRequestMapper::Settings map_request( - PHTTP_FILTER_CONTEXT pfc, PHTTP_FILTER_PREPROC_HEADERS pn, IRequestMapper* mapper, const site_t& site, string& target - ) -{ - // URL path always come from IIS. - dynabuf url(256); - GetHeader(pn,pfc,"url",url,256,false); - - // Port may come from IIS or from site def. - dynabuf port(11); - if (site.m_port.empty() || !g_bNormalizeRequest) - GetServerVariable(pfc,"SERVER_PORT",port,10); - else { - strncpy(port,site.m_port.c_str(),10); - static_cast(port)[10]=0; - } - - // Scheme may come from site def or be derived from IIS. - const char* scheme=site.m_scheme.c_str(); - if (!scheme || !*scheme || !g_bNormalizeRequest) - scheme=pfc->fIsSecurePort ? "https" : "http"; - - // Start with scheme and hostname. - if (g_bNormalizeRequest) { - target = string(scheme) + "://" + site.m_name; - } - else { - dynabuf name(64); - GetServerVariable(pfc,"SERVER_NAME",name,64); - target = string(scheme) + "://" + static_cast(name); + return WriteClientError(pfc,"Shibboleth Filter detected unexpected IIS error."); } - - // If port is non-default, append it. - if ((!strcmp(scheme,"http") && port!="80") || (!strcmp(scheme,"https") && port!="443")) - target = target + ':' + static_cast(port); - - // Append path. - if (!url.empty()) - target+=static_cast(url); - - return mapper->getSettingsFromParsedURL(scheme,site.m_name.c_str(),strtoul(port,NULL,10),url); -} - -DWORD WriteClientError(PHTTP_FILTER_CONTEXT pfc, const IApplication* app, const char* page, ShibMLP& mlp) -{ - const IPropertySet* props=app->getPropertySet("Errors"); - if (props) { - pair p=props->getString(page); - if (p.first) { - ifstream infile(p.second); - if (!infile.fail()) { - const char* res = mlp.run(infile,props); - if (res) { - static const char* ctype="Connection: close\r\nContent-Type: text/html\r\n\r\n"; - pfc->ServerSupportFunction(pfc,SF_REQ_SEND_RESPONSE_HEADER,"200 OK",(DWORD)ctype,0); - DWORD resplen=strlen(res); - pfc->WriteClient(pfc,(LPVOID)res,&resplen,0); - return SF_STATUS_REQ_FINISHED; - } - } - } + catch (exception& e) { + LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, e.what()); + return WriteClientError(pfc,"Shibboleth Filter caught an exception, check Event Log for details."); } - - LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, "Filter unable to open error template."); - return WriteClientError(pfc,"Unable to open error template, check settings."); -} - -DWORD WriteRedirectPage(PHTTP_FILTER_CONTEXT pfc, const IApplication* app, const char* file, ShibMLP& mlp, const char* headers=NULL) -{ - ifstream infile(file); - if (!infile.fail()) { - const char* res = mlp.run(infile,app->getPropertySet("Errors")); - if (res) { - char buf[255]; - sprintf(buf,"Content-Length: %u\r\nContent-Type: text/html\r\n\r\n",strlen(res)); - if (headers) { - string h(headers); - h+=buf; - pfc->ServerSupportFunction(pfc,SF_REQ_SEND_RESPONSE_HEADER,"200 OK",(DWORD)h.c_str(),0); - } - else - pfc->ServerSupportFunction(pfc,SF_REQ_SEND_RESPONSE_HEADER,"200 OK",(DWORD)buf,0); - DWORD resplen=strlen(res); - pfc->WriteClient(pfc,(LPVOID)res,&resplen,0); - return SF_STATUS_REQ_FINISHED; - } - } - LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, "Extension unable to open redirect template."); - return WriteClientError(pfc,"Unable to open redirect template, check settings."); -} - -extern "C" DWORD WINAPI HttpFilterProc(PHTTP_FILTER_CONTEXT pfc, DWORD notificationType, LPVOID pvNotification) -{ - // Is this a log notification? - if (notificationType==SF_NOTIFY_LOG) - { - if (pfc->pFilterContext) - ((PHTTP_FILTER_LOG)pvNotification)->pszClientUserName=static_cast(pfc->pFilterContext); - return SF_STATUS_REQ_NEXT_NOTIFICATION; - } - - PHTTP_FILTER_PREPROC_HEADERS pn=(PHTTP_FILTER_PREPROC_HEADERS)pvNotification; - try - { - // Determine web site number. This can't really fail, I don't think. - dynabuf buf(128); - GetServerVariable(pfc,"INSTANCE_ID",buf,10); - - // Match site instance to host name, skip if no match. - map::const_iterator map_i=g_Sites.find(static_cast(buf)); - if (map_i==g_Sites.end()) - return SF_STATUS_REQ_NEXT_NOTIFICATION; - - ostringstream threadid; - threadid << "[" << getpid() << "] isapi_shib" << '\0'; - saml::NDC ndc(threadid.str().c_str()); - - // We lock the configuration system for the duration. - IConfig* conf=g_Config->getINI(); - Locker locker(conf); - - // Map request to application and content settings. - string targeturl; - IRequestMapper* mapper=conf->getRequestMapper(); - Locker locker2(mapper); - IRequestMapper::Settings settings=map_request(pfc,pn,mapper,map_i->second,targeturl); - pair application_id=settings.first->getString("applicationId"); - const IApplication* application=conf->getApplication(application_id.second); - if (!application) - return WriteClientError(pfc,"Unable to map request to application settings, check configuration."); - - // Declare SHIRE object for this request. - SHIRE shire(application); - - const char* shireURL=shire.getShireURL(targeturl.c_str()); - if (!shireURL) - return WriteClientError(pfc,"Unable to map request to proper shireURL setting, check configuration."); - - // If the user is accessing the SHIRE acceptance point, pass it on. - if (targeturl.find(shireURL)!=string::npos) - return SF_STATUS_REQ_NEXT_NOTIFICATION; - - // Now check the policy for this request. - pair requireSession=settings.first->getBool("requireSession"); - pair shib_cookie=shire.getCookieNameProps(); - pair httpRedirects=application->getPropertySet("Sessions")->getBool("httpRedirects"); - pair redirectPage=application->getPropertySet("Sessions")->getString("redirectPage"); - if (httpRedirects.first && !httpRedirects.second && !redirectPage.first) - return WriteClientError(pfc,"HTML-based redirection requires a redirectPage property."); - - // Check for session cookie. - const char* session_id=NULL; - GetHeader(pn,pfc,"Cookie:",buf,128,false); - Category::getInstance("isapi_shib.HttpFilterProc").debug("cookie header is {%s}",(const char*)buf); - if (!buf.empty() && (session_id=strstr(buf,shib_cookie.first))) { - session_id+=strlen(shib_cookie.first) + 1; /* Skip over the '=' */ - char* cookieend=strchr(session_id,';'); - if (cookieend) - *cookieend = '\0'; /* Ignore anyting after a ; */ - } - - if (!session_id || !*session_id) { - // If no session required, bail now. - if (!requireSession.second) - return SF_STATUS_REQ_NEXT_NOTIFICATION; - - // No acceptable cookie, and we require a session. Generate an AuthnRequest. - const char* areq = shire.getAuthnRequest(targeturl.c_str()); - if (!httpRedirects.first || httpRedirects.second) { - string hdrs=string("Location: ") + areq + "\r\n" - "Content-Type: text/html\r\n" - "Content-Length: 40\r\n" - "Expires: 01-Jan-1997 12:00:00 GMT\r\n" - "Cache-Control: private,no-store,no-cache\r\n\r\n"; - pfc->ServerSupportFunction(pfc,SF_REQ_SEND_RESPONSE_HEADER,"302 Please Wait",(DWORD)hdrs.c_str(),0); - static const char* redmsg="Redirecting..."; - DWORD resplen=40; - pfc->WriteClient(pfc,(LPVOID)redmsg,&resplen,0); - return SF_STATUS_REQ_FINISHED; - } - else { - ShibMLP markupProcessor; - markupProcessor.insert("requestURL",areq); - return WriteRedirectPage(pfc, application, redirectPage.second, markupProcessor); - } - } - - // Make sure this session is still valid. - RPCError* status = NULL; - ShibMLP markupProcessor; - markupProcessor.insert("requestURL", targeturl); - - dynabuf abuf(16); - GetServerVariable(pfc,"REMOTE_ADDR",abuf,16); - try { - status = shire.sessionIsValid(session_id, abuf); - } - catch (ShibTargetException &e) { - markupProcessor.insert("errorType", "Session Processing Error"); - markupProcessor.insert("errorText", e.what()); - markupProcessor.insert("errorDesc", "An error occurred while processing your request."); - return WriteClientError(pfc, application, "shire", markupProcessor); - } -#ifndef _DEBUG - catch (...) { - markupProcessor.insert("errorType", "Session Processing Error"); - markupProcessor.insert("errorText", "Unexpected Exception"); - markupProcessor.insert("errorDesc", "An error occurred while processing your request."); - return WriteClientError(pfc, application, "shire", markupProcessor); - } -#endif - - // Check the status - if (status->isError()) { - if (!requireSession.second) - return SF_STATUS_REQ_NEXT_NOTIFICATION; - else if (status->isRetryable()) { - // Oops, session is invalid. Generate AuthnRequest. - delete status; - const char* areq = shire.getAuthnRequest(targeturl.c_str()); - if (!httpRedirects.first || httpRedirects.second) { - string hdrs=string("Location: ") + areq + "\r\n" - "Content-Type: text/html\r\n" - "Content-Length: 40\r\n" - "Expires: 01-Jan-1997 12:00:00 GMT\r\n" - "Cache-Control: private,no-store,no-cache\r\n\r\n"; - pfc->ServerSupportFunction(pfc,SF_REQ_SEND_RESPONSE_HEADER,"302 Please Wait",(DWORD)hdrs.c_str(),0); - static const char* redmsg="Redirecting..."; - DWORD resplen=40; - pfc->WriteClient(pfc,(LPVOID)redmsg,&resplen,0); - return SF_STATUS_REQ_FINISHED; - } - else { - markupProcessor.insert("requestURL",areq); - return WriteRedirectPage(pfc, application, redirectPage.second, markupProcessor); - } - } - else { - // return the error page to the user - markupProcessor.insert(*status); - delete status; - return WriteClientError(pfc, application, "shire", markupProcessor); - } - } - delete status; - - // Move to RM phase. - RM rm(application); - vector assertions; - SAMLAuthenticationStatement* sso_statement=NULL; - - try { - status = rm.getAssertions(session_id, abuf, assertions, &sso_statement); - } - catch (ShibTargetException &e) { - markupProcessor.insert("errorType", "Attribute Processing Error"); - markupProcessor.insert("errorText", e.what()); - markupProcessor.insert("errorDesc", "An error occurred while processing your request."); - return WriteClientError(pfc, application, "rm", markupProcessor); - } - #ifndef _DEBUG - catch (...) { - markupProcessor.insert("errorType", "Attribute Processing Error"); - markupProcessor.insert("errorText", "Unexpected Exception"); - markupProcessor.insert("errorDesc", "An error occurred while processing your request."); - return WriteClientError(pfc, application, "rm", markupProcessor); - } - #endif - - if (status->isError()) { - markupProcessor.insert(*status); - delete status; - return WriteClientError(pfc, application, "rm", markupProcessor); - } - delete status; - - // Do we have an access control plugin? - if (settings.second) { - Locker acllock(settings.second); - if (!settings.second->authorized(*sso_statement,assertions)) { - for (int k = 0; k < assertions.size(); k++) - delete assertions[k]; - delete sso_statement; - return WriteClientError(pfc, application, "access", markupProcessor); - } - } - - // Get the AAP providers, which contain the attribute policy info. - Iterator provs=application->getAAPProviders(); - - // Clear out the list of mapped attributes - while (provs.hasNext()) { - IAAP* aap=provs.next(); - aap->lock(); - try { - Iterator rules=aap->getAttributeRules(); - while (rules.hasNext()) { - const char* header=rules.next()->getHeader(); - if (header) { - string hname=string(header) + ':'; - pn->SetHeader(pfc,const_cast(hname.c_str()),""); - } - } - } - catch(...) { - aap->unlock(); - for (int k = 0; k < assertions.size(); k++) - delete assertions[k]; - delete sso_statement; - markupProcessor.insert("errorType", "Attribute Processing Error"); - markupProcessor.insert("errorText", "Unexpected Exception"); - markupProcessor.insert("errorDesc", "An error occurred while processing your request."); - return WriteClientError(pfc, application, "rm", markupProcessor); - } - aap->unlock(); - } - provs.reset(); - - // Maybe export the first assertion. - pn->SetHeader(pfc,"remote-user:",""); - pn->SetHeader(pfc,"Shib-Attributes:",""); - pair exp=settings.first->getBool("exportAssertion"); - if (exp.first && exp.second && assertions.size()) { - string assertion; - RM::serialize(*(assertions[0]), assertion); - string::size_type lfeed; - while ((lfeed=assertion.find('\n'))!=string::npos) - assertion.erase(lfeed,1); - pn->SetHeader(pfc,"Shib-Attributes:",const_cast(assertion.c_str())); - } - - pn->SetHeader(pfc,"Shib-Origin-Site:",""); - pn->SetHeader(pfc,"Shib-Authentication-Method:",""); - pn->SetHeader(pfc,"Shib-NameIdentifier-Format:",""); - - // Export the SAML AuthnMethod and the origin site name. - auto_ptr_char os(sso_statement->getSubject()->getNameIdentifier()->getNameQualifier()); - auto_ptr_char am(sso_statement->getAuthMethod()); - pn->SetHeader(pfc,"Shib-Origin-Site:", const_cast(os.get())); - pn->SetHeader(pfc,"Shib-Authentication-Method:", const_cast(am.get())); - - // Export NameID? - AAP wrapper(provs,sso_statement->getSubject()->getNameIdentifier()->getFormat(),Constants::SHIB_ATTRIBUTE_NAMESPACE_URI); - if (!wrapper.fail() && wrapper->getHeader()) { - auto_ptr_char form(sso_statement->getSubject()->getNameIdentifier()->getFormat()); - auto_ptr_char nameid(sso_statement->getSubject()->getNameIdentifier()->getName()); - pn->SetHeader(pfc,"Shib-NameIdentifier-Format:",const_cast(form.get())); - if (!strcmp(wrapper->getHeader(),"REMOTE_USER")) { - char* principal=const_cast(nameid.get()); - pn->SetHeader(pfc,"remote-user:",principal); - pfc->pFilterContext=pfc->AllocMem(pfc,strlen(principal)+1,0); - if (pfc->pFilterContext) - strcpy(static_cast(pfc->pFilterContext),principal); - } - else { - string hname=string(wrapper->getHeader()) + ':'; - pn->SetHeader(pfc,const_cast(wrapper->getHeader()),const_cast(nameid.get())); - } - } - - pn->SetHeader(pfc,"Shib-Application-ID:",""); - pn->SetHeader(pfc,"Shib-Application-ID:",const_cast(application_id.second)); - - // Export the attributes. - Iterator a_iter(assertions); - while (a_iter.hasNext()) { - SAMLAssertion* assert=a_iter.next(); - Iterator statements=assert->getStatements(); - while (statements.hasNext()) { - SAMLAttributeStatement* astate=dynamic_cast(statements.next()); - if (!astate) - continue; - Iterator attrs=astate->getAttributes(); - while (attrs.hasNext()) { - SAMLAttribute* attr=attrs.next(); - - // Are we supposed to export it? - AAP wrapper(provs,attr->getName(),attr->getNamespace()); - if (wrapper.fail() || !wrapper->getHeader()) - continue; - - Iterator vals=attr->getSingleByteValues(); - if (!strcmp(wrapper->getHeader(),"REMOTE_USER") && vals.hasNext()) { - char* principal=const_cast(vals.next().c_str()); - pn->SetHeader(pfc,"remote-user:",principal); - pfc->pFilterContext=pfc->AllocMem(pfc,strlen(principal)+1,0); - if (pfc->pFilterContext) - strcpy(static_cast(pfc->pFilterContext),principal); - } - else { - int it=0; - string header; - string hname=string(wrapper->getHeader()) + ':'; - GetHeader(pn,pfc,const_cast(hname.c_str()),buf,256,false); - if (!buf.empty()) { - header=buf; - it++; - } - for (; vals.hasNext(); it++) { - string value = vals.next(); - for (string::size_type pos = value.find_first_of(";", string::size_type(0)); - pos != string::npos; - pos = value.find_first_of(";", pos)) { - value.insert(pos, "\\"); - pos += 2; - } - if (it == 0) - header=value; - else - header=header + ';' + value; - } - pn->SetHeader(pfc,const_cast(hname.c_str()),const_cast(header.c_str())); - } - } - } - } - - // clean up memory - for (int k = 0; k < assertions.size(); k++) - delete assertions[k]; - delete sso_statement; - - return SF_STATUS_REQ_NEXT_NOTIFICATION; - } - catch(bad_alloc) { - return WriteClientError(pfc,"Out of Memory"); - } - catch(DWORD e) { - if (e==ERROR_NO_DATA) - return WriteClientError(pfc,"A required variable or header was empty."); - else - return WriteClientError(pfc,"Server detected unexpected IIS error."); - } -#ifndef _DEBUG catch(...) { - return WriteClientError(pfc,"Server caught an unknown exception."); + LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, "Shibboleth Filter threw an unknown exception."); + if (g_catchAll) + return WriteClientError(pfc,"Shibboleth Filter threw an unknown exception."); + throw; } -#endif - return WriteClientError(pfc,"Server reached unreachable code, save my walrus!"); + return WriteClientError(pfc,"Shibboleth Filter reached unreachable code, save my walrus!"); } -#endif // 0 + /****************************************************************************/ // ISAPI Extension @@ -1044,20 +626,29 @@ DWORD WriteClientError(LPEXTENSION_CONTROL_BLOCK lpECB, const char* msg) } -class ShibTargetIsapiE : public ShibTarget +class ShibTargetIsapiE : public AbstractSPRequest { LPEXTENSION_CONTROL_BLOCK m_lpECB; - string m_cookie; - Category* m_log; + multimap m_headers; + mutable vector m_certs; + mutable string m_body; + mutable bool m_gotBody; + int m_port; + string m_scheme,m_hostname,m_uri; + mutable string m_remote_addr,m_remote_user; public: ShibTargetIsapiE(LPEXTENSION_CONTROL_BLOCK lpECB, const site_t& site) - : m_log(&Category::getInstance("isapi_shib_filter")) - { + : AbstractSPRequest(SHIBSP_LOGCAT".ISAPI"), m_lpECB(lpECB), m_gotBody(false) { dynabuf ssl(5); GetServerVariable(lpECB,"HTTPS",ssl,5); bool SSL=(ssl=="on" || ssl=="ON"); + // Scheme may come from site def or be derived from IIS. + m_scheme=site.m_scheme; + if (m_scheme.empty() || !g_bNormalizeRequest) + m_scheme = SSL ? "https" : "http"; + // URL path always come from IIS. dynabuf url(256); GetServerVariable(lpECB,"URL",url,255); @@ -1074,22 +665,15 @@ public: strncpy(port,site.m_port.c_str(),10); static_cast(port)[10]=0; } + m_port = atoi(port); - // Scheme may come from site def or be derived from IIS. - const char* scheme=site.m_scheme.c_str(); - if (!scheme || !*scheme || !g_bNormalizeRequest) { - scheme = SSL ? "https" : "http"; - } - - // Get the other server variables. - dynabuf remote_addr(16),hostname(32); - GetServerVariable(lpECB, "REMOTE_ADDR", remote_addr, 16); - GetServerVariable(lpECB, "SERVER_NAME", hostname, 32); + dynabuf var(32); + GetServerVariable(lpECB, "SERVER_NAME", var, 32); // Make sure SERVER_NAME is "authorized" for use on this site. If not, set to canonical name. - const char* host=hostname; - if (site.m_name!=host && site.m_aliases.find(host)==site.m_aliases.end()) - host=site.m_name.c_str(); + m_hostname=var; + if (site.m_name!=m_hostname && site.m_aliases.find(m_hostname)==site.m_aliases.end()) + m_hostname=site.m_name; /* * IIS screws us over on PATH_INFO (the hits keep on coming). We need to figure out if @@ -1108,132 +692,200 @@ public: * PathInfo: /SAML/POST */ - string fullurl; - + string uri; + // Clearly we're only in bad mode if path info exists at all. if (lpECB->lpszPathInfo && *(lpECB->lpszPathInfo)) { if (strstr(lpECB->lpszPathInfo,url)) // Pretty good chance we're in bad mode, unless the PathInfo repeats the path itself. - fullurl=lpECB->lpszPathInfo; + uri = lpECB->lpszPathInfo; else { - fullurl+=url; - fullurl+=lpECB->lpszPathInfo; + uri = url; + uri += lpECB->lpszPathInfo; } } + else { + uri = url; + } // For consistency with Apache, let's add the query string. if (lpECB->lpszQueryString && *(lpECB->lpszQueryString)) { - fullurl+='?'; - fullurl+=lpECB->lpszQueryString; + uri += '?'; + uri += lpECB->lpszQueryString; } - init(g_Config, scheme, host, atoi(port), fullurl.c_str(), lpECB->lpszContentType, remote_addr, lpECB->lpszMethod); - m_lpECB = lpECB; + setRequestURI(uri.c_str()); } ~ShibTargetIsapiE() { } - virtual void log(ShibLogLevel level, const string &msg) { - if (level == LogLevelError) + const char* getScheme() const { + return m_scheme.c_str(); + } + const char* getHostname() const { + return m_hostname.c_str(); + } + int getPort() const { + return m_port; + } + const char* getMethod() const { + return m_lpECB->lpszMethod; + } + string getContentType() const { + return m_lpECB->lpszContentType ? m_lpECB->lpszContentType : ""; + } + long getContentLength() const { + return m_lpECB->cbTotalBytes; + } + string getRemoteUser() const { + if (m_remote_user.empty()) { + dynabuf var(16); + GetServerVariable(m_lpECB, "REMOTE_USER", var, 32, false); + if (!var.empty()) + m_remote_user = var; + } + return m_remote_user; + } + string getRemoteAddr() const { + if (m_remote_addr.empty()) { + dynabuf var(16); + GetServerVariable(m_lpECB, "REMOTE_ADDR", var, 16, false); + if (!var.empty()) + m_remote_addr = var; + } + return m_remote_addr; + } + void log(SPLogLevel level, const string& msg) const { + AbstractSPRequest::log(level,msg); + if (level >= SPError) LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, msg.c_str()); - m_log->log( - (level == LogLevelDebug ? Priority::DEBUG : - (level == LogLevelInfo ? Priority::INFO : - (level == LogLevelWarn ? Priority::WARN : Priority::ERROR))), - msg - ); } - virtual string getCookies() const { + string getHeader(const char* name) const { + string hdr("HTTP_"); + for (; *name; ++name) { + if (*name=='-') + hdr += '_'; + else + hdr += toupper(*name); + } dynabuf buf(128); - GetServerVariable(m_lpECB, "HTTP_COOKIE", buf, 128, false); + GetServerVariable(m_lpECB, const_cast(hdr.c_str()), buf, 128, false); return buf.empty() ? "" : buf; } - virtual void setCookie(const string &name, const string &value) { - // Set the cookie for later. Use it during the redirect. - m_cookie += "Set-Cookie: " + name + "=" + value + "\r\n"; + void setResponseHeader(const char* name, const char* value) { + // Set for later. + if (value) + m_headers.insert(make_pair(name,value)); + else + m_headers.erase(name); } - virtual string getArgs(void) { - return string(m_lpECB->lpszQueryString ? m_lpECB->lpszQueryString : ""); + const char* getQueryString() const { + return m_lpECB->lpszQueryString; } - virtual string getPostData(void) { + const char* getRequestBody() const { + if (m_gotBody) + return m_body.c_str(); if (m_lpECB->cbTotalBytes > 1024*1024) // 1MB? - throw FatalProfileException("Blocked too-large a submission to profile endpoint."); - else if (m_lpECB->cbTotalBytes != m_lpECB->cbAvailable) { - string cgistr; + throw opensaml::SecurityPolicyException("Size of request body exceeded 1M size limit."); + else if (m_lpECB->cbTotalBytes > m_lpECB->cbAvailable) { + m_gotBody=true; char buf[8192]; DWORD datalen=m_lpECB->cbTotalBytes; while (datalen) { DWORD buflen=8192; BOOL ret = m_lpECB->ReadClient(m_lpECB->ConnID, buf, &buflen); if (!ret || !buflen) - throw FatalProfileException("Error reading profile submission from browser."); - cgistr.append(buf, buflen); + throw IOException("Error reading request body from browser."); + m_body.append(buf, buflen); datalen-=buflen; } - return cgistr; } - else - return string(reinterpret_cast(m_lpECB->lpbData),m_lpECB->cbAvailable); - } - virtual void* sendPage( - const string &msg, - int code=200, - const string& content_type="text/html", - const Iterator& headers=EMPTY(header_t)) { - string hdr = string ("Connection: close\r\nContent-type: ") + content_type + "\r\n"; - for (int k = 0; k < headers.size(); k++) { - hdr += headers[k].first + ": " + headers[k].second + "\r\n"; + else if (m_lpECB->cbAvailable) { + m_gotBody=true; + m_body.assign(reinterpret_cast(m_lpECB->lpbData),m_lpECB->cbAvailable); } + return m_body.c_str(); + } + long sendResponse(istream& in, long status) { + string hdr = string("Connection: close\r\n"); + for (multimap::const_iterator i=m_headers.begin(); i!=m_headers.end(); ++i) + hdr += i->first + ": " + i->second + "\r\n"; hdr += "\r\n"; const char* codestr="200 OK"; - switch (code) { - case 403: codestr="403 Forbidden"; break; - case 404: codestr="404 Not Found"; break; - case 500: codestr="500 Server Error"; break; + switch (status) { + case XMLTOOLING_HTTP_STATUS_UNAUTHORIZED: codestr="401 Authorization Required"; break; + case XMLTOOLING_HTTP_STATUS_FORBIDDEN: codestr="403 Forbidden"; break; + case XMLTOOLING_HTTP_STATUS_NOTFOUND: codestr="404 Not Found"; break; + case XMLTOOLING_HTTP_STATUS_ERROR: codestr="500 Server Error"; break; } m_lpECB->ServerSupportFunction(m_lpECB->ConnID, HSE_REQ_SEND_RESPONSE_HEADER, (void*)codestr, 0, (LPDWORD)hdr.c_str()); - DWORD resplen = msg.size(); - m_lpECB->WriteClient(m_lpECB->ConnID, (LPVOID)msg.c_str(), &resplen, HSE_IO_SYNC); - return (void*)HSE_STATUS_SUCCESS; + char buf[1024]; + while (in) { + in.read(buf,1024); + DWORD resplen = in.gcount(); + m_lpECB->WriteClient(m_lpECB->ConnID, buf, &resplen, HSE_IO_SYNC); + } + return HSE_STATUS_SUCCESS; } - virtual void* sendRedirect(const string& url) { - // XXX: Don't support the httpRedirect option, yet. - string hdrs = m_cookie + "Location: " + url + "\r\n" + long sendRedirect(const char* url) { + string hdr=string("Location: ") + url + "\r\n" "Content-Type: text/html\r\n" "Content-Length: 40\r\n" "Expires: 01-Jan-1997 12:00:00 GMT\r\n" - "Cache-Control: private,no-store,no-cache\r\n\r\n"; - m_lpECB->ServerSupportFunction(m_lpECB->ConnID, HSE_REQ_SEND_RESPONSE_HEADER, - "302 Moved", 0, (LPDWORD)hdrs.c_str()); + "Cache-Control: private,no-store,no-cache\r\n"; + for (multimap::const_iterator i=m_headers.begin(); i!=m_headers.end(); ++i) + hdr += i->first + ": " + i->second + "\r\n"; + hdr += "\r\n"; + m_lpECB->ServerSupportFunction(m_lpECB->ConnID, HSE_REQ_SEND_RESPONSE_HEADER, "302 Moved", 0, (LPDWORD)hdr.c_str()); static const char* redmsg="Redirecting..."; DWORD resplen=40; m_lpECB->WriteClient(m_lpECB->ConnID, (LPVOID)redmsg, &resplen, HSE_IO_SYNC); - return (void*)HSE_STATUS_SUCCESS; + return HSE_STATUS_SUCCESS; } // Decline happens in the POST processor if this isn't the shire url // Note that it can also happen with HTAccess, but we don't support that, yet. - virtual void* returnDecline(void) { - return (void*) - WriteClientError(m_lpECB, "ISAPI extension can only be invoked to process Shibboleth protocol requests." - "Make sure the mapped file extension doesn't match actual content."); + long returnDecline() { + return WriteClientError( + m_lpECB, + "ISAPI extension can only be invoked to process Shibboleth protocol requests." + "Make sure the mapped file extension doesn't match actual content." + ); + } + long returnOK() { + return HSE_STATUS_SUCCESS; + } + + const vector& getClientCertificates() const { + if (m_certs.empty()) { + char CertificateBuf[8192]; + CERT_CONTEXT_EX ccex; + ccex.cbAllocated = sizeof(CertificateBuf); + ccex.CertContext.pbCertEncoded = (BYTE*)CertificateBuf; + DWORD dwSize = sizeof(ccex); + + if (m_lpECB->ServerSupportFunction(m_lpECB->ConnID, HSE_REQ_GET_CERT_INFO_EX, (LPVOID)&ccex, (LPDWORD)dwSize, NULL)) { + if (ccex.CertContext.cbCertEncoded) { + unsigned int outlen; + XMLByte* serialized = Base64::encode(reinterpret_cast(CertificateBuf), ccex.CertContext.cbCertEncoded, &outlen); + m_certs.push_back(reinterpret_cast(serialized)); + XMLString::release(&serialized); + } + } + } + return m_certs; } - virtual void* returnOK(void) { return (void*) HSE_STATUS_SUCCESS; } // Not used in the extension. - virtual void clearHeader(const string &name) { throw runtime_error("clearHeader not implemented"); } - virtual void setHeader(const string &name, const string &value) { throw runtime_error("setHeader not implemented"); } - virtual string getHeader(const string &name) { throw runtime_error("getHeader not implemented"); } - virtual void setRemoteUser(const string &user) { throw runtime_error("setRemoteUser not implemented"); } - virtual string getRemoteUser(void) { throw runtime_error("getRemoteUser not implemented"); } + void clearHeader(const char* rawname, const char* cginame) { throw runtime_error("clearHeader not implemented"); } + void setHeader(const char* name, const char* value) { throw runtime_error("setHeader not implemented"); } + void setRemoteUser(const char* user) { throw runtime_error("setRemoteUser not implemented"); } }; extern "C" DWORD WINAPI HttpExtensionProc(LPEXTENSION_CONTROL_BLOCK lpECB) { - string targeturl; - const IApplication* application=NULL; try { ostringstream threadid; threadid << "[" << getpid() << "] isapi_shib_extension" << '\0'; - saml::NDC ndc(threadid.str().c_str()); + xmltooling::NDC ndc(threadid.str().c_str()); // Determine web site number. This can't really fail, I don't think. dynabuf buf(128); @@ -1245,8 +897,8 @@ extern "C" DWORD WINAPI HttpExtensionProc(LPEXTENSION_CONTROL_BLOCK lpECB) return WriteClientError(lpECB, "Shibboleth Extension not configured for this web site."); ShibTargetIsapiE ste(lpECB, map_i->second); - pair res = ste.doHandler(); - if (res.first) return (DWORD)res.second; + pair res = ste.getServiceProvider().doHandler(ste); + if (res.first) return res.second; return WriteClientError(lpECB, "Shibboleth Extension failed to process request"); @@ -1260,333 +912,17 @@ extern "C" DWORD WINAPI HttpExtensionProc(LPEXTENSION_CONTROL_BLOCK lpECB) else return WriteClientError(lpECB,"Server detected unexpected IIS error."); } -#ifndef _DEBUG + catch (exception& e) { + LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, e.what()); + return WriteClientError(lpECB,"Shibboleth Extension caught an exception, check Event Log for details."); + } catch(...) { - return WriteClientError(lpECB,"Server caught an unknown exception."); + LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, "Shibboleth Extension threw an unknown exception."); + if (g_catchAll) + return WriteClientError(lpECB,"Shibboleth Extension threw an unknown exception."); + throw; } -#endif // If we get here we've got an error. return HSE_STATUS_ERROR; } - -#if 0 -IRequestMapper::Settings map_request( - LPEXTENSION_CONTROL_BLOCK lpECB, IRequestMapper* mapper, const site_t& site, string& target - ) -{ - dynabuf ssl(5); - GetServerVariable(lpECB,"HTTPS",ssl,5); - bool SSL=(ssl=="on" || ssl=="ON"); - - // URL path always come from IIS. - dynabuf url(256); - GetServerVariable(lpECB,"URL",url,255); - - // Port may come from IIS or from site def. - dynabuf port(11); - if (site.m_port.empty() || !g_bNormalizeRequest) - GetServerVariable(lpECB,"SERVER_PORT",port,10); - else { - strncpy(port,site.m_port.c_str(),10); - static_cast(port)[10]=0; - } - - // Scheme may come from site def or be derived from IIS. - const char* scheme=site.m_scheme.c_str(); - if (!scheme || !*scheme || !g_bNormalizeRequest) { - scheme = SSL ? "https" : "http"; - } - - // Start with scheme and hostname. - if (g_bNormalizeRequest) { - target = string(scheme) + "://" + site.m_name; - } - else { - dynabuf name(64); - GetServerVariable(lpECB,"SERVER_NAME",name,64); - target = string(scheme) + "://" + static_cast(name); - } - - // If port is non-default, append it. - if ((!strcmp(scheme,"http") && port!="80") || (!strcmp(scheme,"https") && port!="443")) - target = target + ':' + static_cast(port); - - // Append path. - if (!url.empty()) - target+=static_cast(url); - - return mapper->getSettingsFromParsedURL(scheme,site.m_name.c_str(),strtoul(port,NULL,10),url); -} - -DWORD WriteClientError(LPEXTENSION_CONTROL_BLOCK lpECB, const IApplication* app, const char* page, ShibMLP& mlp) -{ - const IPropertySet* props=app->getPropertySet("Errors"); - if (props) { - pair p=props->getString(page); - if (p.first) { - ifstream infile(p.second); - if (!infile.fail()) { - const char* res = mlp.run(infile,props); - if (res) { - static const char* ctype="Connection: close\r\nContent-Type: text/html\r\n\r\n"; - lpECB->ServerSupportFunction(lpECB->ConnID,HSE_REQ_SEND_RESPONSE_HEADER,"200 OK",0,(LPDWORD)ctype); - DWORD resplen=strlen(res); - lpECB->WriteClient(lpECB->ConnID,(LPVOID)res,&resplen,0); - return HSE_STATUS_SUCCESS; - } - } - } - } - LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, "Extension unable to open error template."); - return WriteClientError(lpECB,"Unable to open error template, check settings."); -} - -DWORD WriteRedirectPage(LPEXTENSION_CONTROL_BLOCK lpECB, const IApplication* app, const char* file, ShibMLP& mlp, const char* headers=NULL) -{ - ifstream infile(file); - if (!infile.fail()) { - const char* res = mlp.run(infile,app->getPropertySet("Errors")); - if (res) { - char buf[255]; - sprintf(buf,"Content-Length: %u\r\nContent-Type: text/html\r\n\r\n",strlen(res)); - if (headers) { - string h(headers); - h+=buf; - lpECB->ServerSupportFunction(lpECB->ConnID,HSE_REQ_SEND_RESPONSE_HEADER,"200 OK",0,(LPDWORD)h.c_str()); - } - else - lpECB->ServerSupportFunction(lpECB->ConnID,HSE_REQ_SEND_RESPONSE_HEADER,"200 OK",0,(LPDWORD)buf); - DWORD resplen=strlen(res); - lpECB->WriteClient(lpECB->ConnID,(LPVOID)res,&resplen,0); - return HSE_STATUS_SUCCESS; - } - } - LogEvent(NULL, EVENTLOG_ERROR_TYPE, 2100, NULL, "Extension unable to open redirect template."); - return WriteClientError(lpECB,"Unable to open redirect template, check settings."); -} - -extern "C" DWORD WINAPI HttpExtensionProc(LPEXTENSION_CONTROL_BLOCK lpECB) -{ - string targeturl; - const IApplication* application=NULL; - try - { - ostringstream threadid; - threadid << "[" << getpid() << "] shire_handler" << '\0'; - saml::NDC ndc(threadid.str().c_str()); - - // Determine web site number. This can't really fail, I don't think. - dynabuf buf(128); - GetServerVariable(lpECB,"INSTANCE_ID",buf,10); - - // Match site instance to host name, skip if no match. - map::const_iterator map_i=g_Sites.find(static_cast(buf)); - if (map_i==g_Sites.end()) - return WriteClientError(lpECB,"Shibboleth filter not configured for this web site."); - - // We lock the configuration system for the duration. - IConfig* conf=g_Config->getINI(); - Locker locker(conf); - - // Map request to application and content settings. - IRequestMapper* mapper=conf->getRequestMapper(); - Locker locker2(mapper); - IRequestMapper::Settings settings=map_request(lpECB,mapper,map_i->second,targeturl); - pair application_id=settings.first->getString("applicationId"); - application=conf->getApplication(application_id.second); - const IPropertySet* sessionProps=application ? application->getPropertySet("Sessions") : NULL; - if (!application || !sessionProps) - return WriteClientError(lpECB,"Unable to map request to application session settings, check configuration."); - - SHIRE shire(application); - - const char* shireURL=shire.getShireURL(targeturl.c_str()); - if (!shireURL) - return WriteClientError(lpECB,"Unable to map request to proper shireURL setting, check configuration."); - - // Make sure we only process the SHIRE requests. - if (!strstr(targeturl.c_str(),shireURL)) - return WriteClientError(lpECB,"ISAPI extension can only be invoked to process incoming sessions." - "Make sure the mapped file extension doesn't match actual content."); - - pair shib_cookie=shire.getCookieNameProps(); - - // Make sure this is SSL, if it should be - pair shireSSL=sessionProps->getBool("shireSSL"); - if (!shireSSL.first || shireSSL.second) { - GetServerVariable(lpECB,"HTTPS",buf,10); - if (buf!="on") - throw ShibTargetException(SHIBRPC_OK,"blocked non-SSL access to SHIRE POST processor"); - } - - pair httpRedirects=sessionProps->getBool("httpRedirects"); - pair redirectPage=sessionProps->getString("redirectPage"); - if (httpRedirects.first && !httpRedirects.second && !redirectPage.first) - return WriteClientError(lpECB,"HTML-based redirection requires a redirectPage property."); - - // Check for Mac web browser - /* - bool bSafari=false; - dynabuf agent(64); - GetServerVariable(lpECB,"HTTP_USER_AGENT",agent,64); - if (strstr(agent,"AppleWebKit/")) - bSafari=true; - */ - - // If this is a GET, we manufacture an AuthnRequest. - if (!stricmp(lpECB->lpszMethod,"GET")) { - const char* areq=lpECB->lpszQueryString ? shire.getLazyAuthnRequest(lpECB->lpszQueryString) : NULL; - if (!areq) - throw ShibTargetException(SHIBRPC_OK, "malformed arguments to request a new session"); - if (!httpRedirects.first || httpRedirects.second) { - string hdrs=string("Location: ") + areq + "\r\n" - "Content-Type: text/html\r\n" - "Content-Length: 40\r\n" - "Expires: 01-Jan-1997 12:00:00 GMT\r\n" - "Cache-Control: private,no-store,no-cache\r\n\r\n"; - lpECB->ServerSupportFunction(lpECB->ConnID,HSE_REQ_SEND_RESPONSE_HEADER,"302 Moved",0,(LPDWORD)hdrs.c_str()); - static const char* redmsg="Redirecting..."; - DWORD resplen=40; - lpECB->WriteClient(lpECB->ConnID,(LPVOID)redmsg,&resplen,HSE_IO_SYNC); - return HSE_STATUS_SUCCESS; - } - else { - ShibMLP markupProcessor; - markupProcessor.insert("requestURL",areq); - return WriteRedirectPage(lpECB, application, redirectPage.second, markupProcessor); - } - } - else if (stricmp(lpECB->lpszMethod,"POST")) - throw ShibTargetException(SHIBRPC_OK,"blocked non-POST to SHIRE POST processor"); - - // Sure sure this POST is an appropriate content type - if (!lpECB->lpszContentType || stricmp(lpECB->lpszContentType,"application/x-www-form-urlencoded")) - throw ShibTargetException(SHIBRPC_OK,"blocked bad content-type to SHIRE POST processor"); - - // Read the data. - pair elements=pair(NULL,NULL); - if (lpECB->cbTotalBytes > 1024*1024) // 1MB? - throw ShibTargetException(SHIBRPC_OK,"blocked too-large a post to SHIRE POST processor"); - else if (lpECB->cbTotalBytes!=lpECB->cbAvailable) { - string cgistr; - char buf[8192]; - DWORD datalen=lpECB->cbTotalBytes; - while (datalen) { - DWORD buflen=8192; - BOOL ret=lpECB->ReadClient(lpECB->ConnID,buf,&buflen); - if (!ret || !buflen) - throw ShibTargetException(SHIBRPC_OK,"error reading POST data from browser"); - cgistr.append(buf,buflen); - datalen-=buflen; - } - elements=shire.getFormSubmission(cgistr.c_str(),cgistr.length()); - } - else - elements=shire.getFormSubmission(reinterpret_cast(lpECB->lpbData),lpECB->cbAvailable); - - // Make sure the SAML Response parameter exists - if (!elements.first || !*elements.first) - throw ShibTargetException(SHIBRPC_OK, "SHIRE POST failed to find SAMLResponse form element"); - - // Make sure the target parameter exists - if (!elements.second || !*elements.second) - throw ShibTargetException(SHIBRPC_OK, "SHIRE POST failed to find TARGET form element"); - - GetServerVariable(lpECB,"REMOTE_ADDR",buf,16); - - // Process the post. - string cookie; - RPCError* status=NULL; - ShibMLP markupProcessor; - markupProcessor.insert("requestURL", targeturl.c_str()); - try { - status = shire.sessionCreate(elements.first,buf,cookie); - } - catch (ShibTargetException &e) { - markupProcessor.insert("errorType", "Session Creation Service Error"); - markupProcessor.insert("errorText", e.what()); - markupProcessor.insert("errorDesc", "An error occurred while processing your request."); - return WriteClientError(lpECB, application, "shire", markupProcessor); - } -#ifndef _DEBUG - catch (...) { - markupProcessor.insert("errorType", "Session Creation Service Error"); - markupProcessor.insert("errorText", "Unexpected Exception"); - markupProcessor.insert("errorDesc", "An error occurred while processing your request."); - return WriteClientError(lpECB, application, "shire", markupProcessor); - } -#endif - - if (status->isError()) { - if (status->isRetryable()) { - delete status; - const char* loc=shire.getAuthnRequest(elements.second); - if (!httpRedirects.first || httpRedirects.second) { - string hdrs=string("Location: ") + loc + "\r\n" - "Content-Type: text/html\r\n" - "Content-Length: 40\r\n" - "Expires: 01-Jan-1997 12:00:00 GMT\r\n" - "Cache-Control: private,no-store,no-cache\r\n\r\n"; - lpECB->ServerSupportFunction(lpECB->ConnID,HSE_REQ_SEND_RESPONSE_HEADER,"302 Moved",0,(LPDWORD)hdrs.c_str()); - static const char* redmsg="Redirecting..."; - DWORD resplen=40; - lpECB->WriteClient(lpECB->ConnID,(LPVOID)redmsg,&resplen,HSE_IO_SYNC); - return HSE_STATUS_SUCCESS; - } - else { - markupProcessor.insert("requestURL",loc); - return WriteRedirectPage(lpECB, application, redirectPage.second, markupProcessor); - } - } - - // Return this error to the user. - markupProcessor.insert(*status); - delete status; - return WriteClientError(lpECB,application,"shire",markupProcessor); - } - delete status; - - // We've got a good session, set the cookie and redirect to target. - cookie = string("Set-Cookie: ") + shib_cookie.first + '=' + cookie + shib_cookie.second + "\r\n" - "Expires: 01-Jan-1997 12:00:00 GMT\r\n" - "Cache-Control: private,no-store,no-cache\r\n"; - if (!httpRedirects.first || httpRedirects.second) { - cookie=cookie + "Content-Type: text/html\r\nLocation: " + elements.second + "\r\nContent-Length: 40\r\n\r\n"; - lpECB->ServerSupportFunction(lpECB->ConnID,HSE_REQ_SEND_RESPONSE_HEADER,"302 Moved",0,(LPDWORD)cookie.c_str()); - static const char* redmsg="Redirecting..."; - DWORD resplen=40; - lpECB->WriteClient(lpECB->ConnID,(LPVOID)redmsg,&resplen,HSE_IO_SYNC); - return HSE_STATUS_SUCCESS; - } - else { - markupProcessor.insert("requestURL",elements.second); - return WriteRedirectPage(lpECB, application, redirectPage.second, markupProcessor, cookie.c_str()); - } - } - catch (ShibTargetException &e) { - if (application) { - ShibMLP markupProcessor; - markupProcessor.insert("requestURL", targeturl.c_str()); - markupProcessor.insert("errorType", "Session Creation Service Error"); - markupProcessor.insert("errorText", e.what()); - markupProcessor.insert("errorDesc", "An error occurred while processing your request."); - return WriteClientError(lpECB,application,"shire",markupProcessor); - } - } -#ifndef _DEBUG - catch (...) { - if (application) { - ShibMLP markupProcessor; - markupProcessor.insert("requestURL", targeturl.c_str()); - markupProcessor.insert("errorType", "Session Creation Service Error"); - markupProcessor.insert("errorText", "Unexpected Exception"); - markupProcessor.insert("errorDesc", "An error occurred while processing your request."); - return WriteClientError(lpECB,application,"shire",markupProcessor); - } - } -#endif - - return HSE_STATUS_ERROR; -} -#endif // 0