X-Git-Url: http://www.project-moonshot.org/gitweb/?a=blobdiff_plain;f=nsapi_shib%2Fnsapi_shib.cpp;h=d1efdc4be3843bb855bbf9922a97e87713b7801b;hb=HEAD;hp=664c1dbbcc5885e80a2b9aca7da658b574fbb810;hpb=ac19d9c759de99d19c0df40963e6da8a8720155c;p=shibboleth%2Fsp.git diff --git a/nsapi_shib/nsapi_shib.cpp b/nsapi_shib/nsapi_shib.cpp index 664c1db..d1efdc4 100644 --- a/nsapi_shib/nsapi_shib.cpp +++ b/nsapi_shib/nsapi_shib.cpp @@ -1,72 +1,54 @@ /* - * The Shibboleth License, Version 1. - * Copyright (c) 2002 - * University Corporation for Advanced Internet Development, Inc. - * All rights reserved + * Copyright 2001-2007 Internet2 + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * + * http://www.apache.org/licenses/LICENSE-2.0 * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions are met: - * - * Redistributions of source code must retain the above copyright notice, this - * list of conditions and the following disclaimer. - * - * Redistributions in binary form must reproduce the above copyright notice, - * this list of conditions and the following disclaimer in the documentation - * and/or other materials provided with the distribution, if any, must include - * the following acknowledgment: "This product includes software developed by - * the University Corporation for Advanced Internet Development - * Internet2 Project. Alternately, this acknowledegement - * may appear in the software itself, if and wherever such third-party - * acknowledgments normally appear. - * - * Neither the name of Shibboleth nor the names of its contributors, nor - * Internet2, nor the University Corporation for Advanced Internet Development, - * Inc., nor UCAID may be used to endorse or promote products derived from this - * software without specific prior written permission. For written permission, - * please contact shibboleth@shibboleth.org - * - * Products derived from this software may not be called Shibboleth, Internet2, - * UCAID, or the University Corporation for Advanced Internet Development, nor - * may Shibboleth appear in their name, without prior written permission of the - * University Corporation for Advanced Internet Development. - * - * - * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" - * AND WITH ALL FAULTS. ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT - * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A - * PARTICULAR PURPOSE, AND NON-INFRINGEMENT ARE DISCLAIMED AND THE ENTIRE RISK - * OF SATISFACTORY QUALITY, PERFORMANCE, ACCURACY, AND EFFORT IS WITH LICENSEE. - * IN NO EVENT SHALL THE COPYRIGHT OWNER, CONTRIBUTORS OR THE UNIVERSITY - * CORPORATION FOR ADVANCED INTERNET DEVELOPMENT, INC. BE LIABLE FOR ANY DIRECT, - * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES - * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; - * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND - * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT - * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS - * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +/** + * nsapi_shib.cpp + * + * Shibboleth NSAPI filter */ -/* nsapi_shib.cpp - Shibboleth NSAPI filter +#define SHIBSP_LITE - Scott Cantor - 12/13/04 -*/ +#if defined (_MSC_VER) || defined(__BORLANDC__) +# include "config_win32.h" +#else +# include "config.h" +#endif -#include "config_win32.h" +#ifdef WIN32 +# define _CRT_NONSTDC_NO_DEPRECATE 1 +# define _CRT_SECURE_NO_DEPRECATE 1 +#endif -// SAML Runtime -#include -#include -#include -#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include -#include #include #include -#include #ifdef WIN32 +# include # define XP_WIN32 #else # define XP_UNIX @@ -80,31 +62,36 @@ extern "C" #include } +using namespace shibsp; +using namespace xmltooling; using namespace std; -using namespace saml; -using namespace shibboleth; -using namespace shibtarget; // macros to output text to client #define NET_WRITE(str) \ if (IO_ERROR==net_write(sn->csd,str,strlen(str))) return REQ_EXIT namespace { - ShibTargetConfig* g_Config=NULL; + SPConfig* g_Config=NULL; string g_ServerName; string g_ServerScheme; + string g_unsetHeaderValue; + bool g_checkSpoofing = true; + bool g_catchAll = false; + + static const XMLCh path[] = UNICODE_LITERAL_4(p,a,t,h); + static const XMLCh validate[] = UNICODE_LITERAL_8(v,a,l,i,d,a,t,e); } -PlugManager::Factory SunRequestMapFactory; +PluginManager::Factory SunRequestMapFactory; extern "C" NSAPI_PUBLIC void nsapi_shib_exit(void*) { if (g_Config) - g_Config->shutdown(); + g_Config->term(); g_Config = NULL; } -extern "C" NSAPI_PUBLIC int nsapi_shib_init(pblock* pb, Session* sn, Request* rq) +extern "C" NSAPI_PUBLIC int nsapi_shib_init(pblock* pb, ::Session* sn, Request* rq) { // Save off a default hostname for this virtual server. char* name=pblock_findval("server-name",pb); @@ -132,215 +119,270 @@ extern "C" NSAPI_PUBLIC int nsapi_shib_init(pblock* pb, Session* sn, Request* rq log_error(LOG_INFORM,"nsapi_shib_init",sn,rq,"nsapi_shib loaded for host (%s)",g_ServerName.c_str()); -#ifndef _DEBUG - try { -#endif - const char* schemadir=pblock_findval("shib-schemas",pb); - if (!schemadir) - schemadir=getenv("SHIBSCHEMAS"); - if (!schemadir) - schemadir=SHIB_SCHEMAS; - const char* config=pblock_findval("shib-config",pb); - if (!config) - config=getenv("SHIBCONFIG"); - if (!config) - config=SHIB_CONFIG; - g_Config=&ShibTargetConfig::getConfig(); - g_Config->setFeatures( - ShibTargetConfig::Listener | - ShibTargetConfig::Metadata | - ShibTargetConfig::AAP | - ShibTargetConfig::RequestMapper | - ShibTargetConfig::LocalExtensions | - ShibTargetConfig::Logging - ); - if (!g_Config->init(schemadir)) { - g_Config=NULL; - pblock_nvinsert("error","unable to initialize Shibboleth libraries",pb); - return REQ_ABORTED; - } + const char* schemadir=pblock_findval("shib-schemas",pb); + const char* prefix=pblock_findval("shib-prefix",pb); + + g_Config=&SPConfig::getConfig(); + g_Config->setFeatures( + SPConfig::Listener | + SPConfig::Caching | + SPConfig::RequestMapping | + SPConfig::InProcess | + SPConfig::Logging | + SPConfig::Handlers + ); + if (!g_Config->init(schemadir,prefix)) { + g_Config=NULL; + pblock_nvinsert("error","unable to initialize Shibboleth libraries",pb); + return REQ_ABORTED; + } - SAMLConfig::getConfig().getPlugMgr().regFactory(shibtarget::XML::NativeRequestMapType,&SunRequestMapFactory); - // We hijack the legacy type so that 1.2 config files will load this plugin - SAMLConfig::getConfig().getPlugMgr().regFactory(shibtarget::XML::LegacyRequestMapType,&SunRequestMapFactory); + g_Config->RequestMapperManager.registerFactory(XML_REQUEST_MAPPER,&SunRequestMapFactory); - if (!g_Config->load(config)) { - g_Config=NULL; - pblock_nvinsert("error","unable to initialize load Shibboleth configuration",pb); - return REQ_ABORTED; - } + const char* config=pblock_findval("shib-config",pb); + if (!config) + config=getenv("SHIBSP_CONFIG"); + if (!config) + config=SHIBSP_CONFIG; - daemon_atrestart(nsapi_shib_exit,NULL); -#ifndef _DEBUG + try { + xercesc::DOMDocument* dummydoc=XMLToolingConfig::getConfig().getParser().newDocument(); + XercesJanitor docjanitor(dummydoc); + xercesc::DOMElement* dummy = dummydoc->createElementNS(NULL,path); + auto_ptr_XMLCh src(config); + dummy->setAttributeNS(NULL,path,src.get()); + dummy->setAttributeNS(NULL,validate,xmlconstants::XML_ONE); + + g_Config->setServiceProvider(g_Config->ServiceProviderManager.newPlugin(XML_SERVICE_PROVIDER,dummy)); + g_Config->getServiceProvider()->init(); } - catch (...) { + catch (exception& ex) { + pblock_nvinsert("error",ex.what(),pb); + g_Config->term(); g_Config=NULL; - pblock_nvinsert("error","caught exception, unable to initialize Shibboleth libraries",pb); return REQ_ABORTED; } -#endif + + daemon_atrestart(nsapi_shib_exit,NULL); + + ServiceProvider* sp=g_Config->getServiceProvider(); + Locker locker(sp); + const PropertySet* props=sp->getPropertySet("Local"); + if (props) { + pair unsetValue=props->getString("unsetHeaderValue"); + if (unsetValue.first) + g_unsetHeaderValue = unsetValue.second; + pair flag=props->getBool("checkSpoofing"); + g_checkSpoofing = !flag.first || flag.second; + flag=props->getBool("catchAll"); + g_catchAll = flag.first && flag.second; + } return REQ_PROCEED; } /********************************************************************************/ // NSAPI Shib Target Subclass -class ShibTargetNSAPI : public ShibTarget +class ShibTargetNSAPI : public AbstractSPRequest { + mutable string m_body; + mutable bool m_gotBody,m_firsttime; + mutable vector m_certs; + set m_allhttp; + public: - ShibTargetNSAPI(pblock* pb, Session* sn, Request* rq) { - // Get everything but hostname... + pblock* m_pb; + ::Session* m_sn; + Request* m_rq; + + ShibTargetNSAPI(pblock* pb, ::Session* sn, Request* rq) + : AbstractSPRequest(SHIBSP_LOGCAT".NSAPI"), m_gotBody(false), m_firsttime(true), m_pb(pb), m_sn(sn), m_rq(rq) { + const char* uri=pblock_findval("uri", rq->reqpb); const char* qstr=pblock_findval("query", rq->reqpb); - int port=server_portnum; - const char* scheme=security_active ? "https" : "http"; - const char* host=NULL; - string url; - if (uri) - url=uri; - if (qstr) - url=url + '?' + qstr; - + if (qstr) { + string temp = string(uri) + '?' + qstr; + setRequestURI(temp.c_str()); + } + else { + setRequestURI(uri); + } + + // See if this is the first time we've run. + qstr = pblock_findval("auth-type", rq->vars); + if (qstr && !strcmp(qstr, "shibboleth")) + m_firsttime = false; + if (!m_firsttime || rq->orig_rq) + log(SPDebug, "nsapi_shib function running more than once"); + } + ~ShibTargetNSAPI() { } + + const char* getScheme() const { + return security_active ? "https" : "http"; + } + const char* getHostname() const { #ifdef vs_is_default_vs // This is 6.0 or later, so we can distinguish requests to name-based vhosts. - if (!vs_is_default_vs) + if (!vs_is_default_vs(request_get_vs(m_rq))) // The beauty here is, a non-default vhost can *only* be accessed if the client // specified the exact name in the Host header. So we can trust the Host header. - host=pblock_findval("host", rq->headers); + return pblock_findval("host", m_rq->headers); else #endif // In other cases, we're going to rely on the initialization process... - host=g_ServerName.c_str(); - + return g_ServerName.c_str(); + } + int getPort() const { + return server_portnum; + } + const char* getMethod() const { + return pblock_findval("method", m_rq->reqpb); + } + string getContentType() const { char* content_type = ""; - request_header("content-type", &content_type, sn, rq); - - const char *remote_ip = pblock_findval("ip", sn->client); - const char *method = pblock_findval("method", rq->reqpb); - - init(scheme, host, port, url.c_str(), content_type, remote_ip, method); - - m_pb = pb; - m_sn = sn; - m_rq = rq; + request_header("content-type", &content_type, m_sn, m_rq); + return content_type; } - ~ShibTargetNSAPI() {} - - virtual void log(ShibLogLevel level, const string &msg) { - ShibTarget::log(level,msg); - if (level==LogLevelError) - log_error(LOG_FAILURE, "nsapi_shib", m_sn, m_rq, const_cast(msg.c_str())); + long getContentLength() const { + if (m_gotBody) + return m_body.length(); + char* content_length=""; + request_header("content-length", &content_length, m_sn, m_rq); + return atoi(content_length); } - virtual string getCookies(void) const { - char *cookies = NULL; - if (request_header("cookie", &cookies, m_sn, m_rq) == REQ_ABORTED) - throw("error accessing cookie header"); - return string(cookies ? cookies : ""); + string getRemoteAddr() const { + return pblock_findval("ip", m_sn->client); } - virtual void setCookie(const string &name, const string &value) { - string cookie = name + '=' + value; - pblock_nvinsert("Set-Cookie", cookie.c_str(), m_rq->srvhdrs); + void log(SPLogLevel level, const string& msg) const { + AbstractSPRequest::log(level,msg); + if (level>=SPError) + log_error(LOG_FAILURE, "nsapi_shib", m_sn, m_rq, const_cast(msg.c_str())); } - virtual string getArgs(void) { - const char *q = pblock_findval("query", m_rq->reqpb); - return string(q ? q : ""); + const char* getQueryString() const { + return pblock_findval("query", m_rq->reqpb); } - virtual string getPostData(void) { + const char* getRequestBody() const { + if (m_gotBody) + return m_body.c_str(); char* content_length=NULL; - if (request_header("content-length", &content_length, m_sn, m_rq)!=REQ_PROCEED || - atoi(content_length) > 1024*1024) // 1MB? - throw FatalProfileException("Blocked too-large a submission to profile endpoint."); + if (request_header("content-length", &content_length, m_sn, m_rq)!=REQ_PROCEED || atoi(content_length) > 1024*1024) // 1MB? + throw opensaml::SecurityPolicyException("Blocked request body exceeding 1M size limit."); else { char ch=IO_EOF+1; int cl=atoi(content_length); - string cgistr; + m_gotBody=true; while (cl && ch != IO_EOF) { ch=netbuf_getc(m_sn->inbuf); - // Check for error. if(ch==IO_ERROR) break; - cgistr += ch; + m_body += ch; cl--; } if (cl) - throw FatalProfileException("Error reading profile submission from browser."); - return cgistr; + throw IOException("Error reading request body from browser."); + return m_body.c_str(); } } - virtual void clearHeader(const string &name) { - param_free(pblock_remove(name.c_str(), m_rq->headers)); + void clearHeader(const char* rawname, const char* cginame) { + if (g_checkSpoofing && m_firsttime && !m_rq->orig_rq) { + if (m_allhttp.empty()) { + // Populate the set of client-supplied headers for spoof checking. + const pb_entry* entry; + for (int i=0; iheaders->hsize; ++i) { + entry = m_rq->headers->ht[i]; + while (entry) { + string cgiversion("HTTP_"); + const char* pch = entry->param->name; + while (*pch) { + cgiversion += (isalnum(*pch) ? toupper(*pch) : '_'); + pch++; + } + m_allhttp.insert(cgiversion); + entry = entry->next; + } + } + } + if (m_allhttp.count(cginame) > 0) + throw opensaml::SecurityPolicyException("Attempt to spoof header ($1) was detected.", params(1, rawname)); + } + param_free(pblock_remove(rawname, m_rq->headers)); + pblock_nvinsert(rawname, g_unsetHeaderValue.c_str(), m_rq->headers); } - virtual void setHeader(const string &name, const string &value) { - pblock_nvinsert(name.c_str(), value.c_str() ,m_rq->headers); + void setHeader(const char* name, const char* value) { + param_free(pblock_remove(name, m_rq->headers)); + pblock_nvinsert(name, value, m_rq->headers); } - virtual string getHeader(const string &name) { - char *hdr = NULL; - if (request_header(const_cast(name.c_str()), &hdr, m_sn, m_rq) != REQ_PROCEED) - hdr = NULL; + string getHeader(const char* name) const { + // NSAPI headers tend to be lower case. We'll special case "cookie" since it's used a lot. + char* hdr = NULL; + int cookie = strcmp(name, "Cookie"); + if (cookie == 0) + name = "cookie"; + if (request_header(const_cast(name), &hdr, m_sn, m_rq) != REQ_PROCEED) { + // We didn't get a hit, so we'll try a lower-casing operation, unless we already did... + if (cookie == 0) + return ""; + string n; + while (*name) + n += tolower(*(name++)); + if (request_header(const_cast(n.c_str()), &hdr, m_sn, m_rq) != REQ_PROCEED) + return ""; + } return string(hdr ? hdr : ""); } - virtual void setRemoteUser(const string &user) { - pblock_nvinsert("remote-user", user.c_str(), m_rq->headers); - pblock_nvinsert("auth-user", user.c_str(), m_rq->vars); + void setRemoteUser(const char* user) { + pblock_nvinsert("auth-user", user, m_rq->vars); } - virtual string getRemoteUser(void) { - return getHeader("remote-user"); + string getRemoteUser() const { + const char* ru = pblock_findval("auth-user", m_rq->vars); + return ru ? ru : ""; } - // Override this function because we want to add the NSAPI Directory override - /* - virtual pair getRequireSession(IRequestMapper::Settings &settings) { - pair requireSession=settings.first->getBool("requireSession"); - if (!requireSession.first || !requireSession.second) { - const char* param=pblock_findval("require-session",pb); - if (param && (!strcmp(param,"1") || !strcasecmp(param,"true"))) - requireSession.second=true; - } - return requireSession; + void setResponseHeader(const char* name, const char* value) { + pblock_nvinsert(name, value, m_rq->srvhdrs); } - */ - virtual void* sendPage( - const string& msg, - int code=200, - const string& content_type="text/html", - const saml::Iterator& headers=EMPTY(header_t) - ) { - pblock_nvinsert("Content-Type", content_type.c_str(), m_rq->srvhdrs); - pblock_nninsert("Content-Length", msg.length(), m_rq->srvhdrs); - pblock_nvinsert("Connection","close",m_rq->srvhdrs); - while (headers.hasNext()) { - const header_t& h=headers.next(); - pblock_nvinsert(h.first.c_str(), h.second.c_str(), m_rq->srvhdrs); + long sendResponse(istream& in, long status) { + string msg; + char buf[1024]; + while (in) { + in.read(buf,1024); + msg.append(buf,in.gcount()); } - protocol_status(m_sn, m_rq, code, NULL); + pblock_nvinsert("connection","close",m_rq->srvhdrs); + pblock_nninsert("content-length", msg.length(), m_rq->srvhdrs); + protocol_status(m_sn, m_rq, status, NULL); + protocol_start_response(m_sn, m_rq); net_write(m_sn->csd,const_cast(msg.c_str()),msg.length()); - return (void*)REQ_EXIT; + return REQ_EXIT; } - virtual void* sendRedirect(const string& url) { - pblock_nvinsert("Content-Type", "text/html", m_rq->srvhdrs); - pblock_nninsert("Content-Length", 40, m_rq->srvhdrs); - pblock_nvinsert("Expires", "01-Jan-1997 12:00:00 GMT", m_rq->srvhdrs); - pblock_nvinsert("Cache-Control", "private,no-store,no-cache", m_rq->srvhdrs); - pblock_nvinsert("Location", url.c_str(), m_rq->srvhdrs); - protocol_status(m_sn, m_rq, PROTOCOL_REDIRECT, "302 Please wait"); + long sendRedirect(const char* url) { + param_free(pblock_remove("content-type", m_rq->srvhdrs)); + pblock_nninsert("content-length", 0, m_rq->srvhdrs); + pblock_nvinsert("expires", "01-Jan-1997 12:00:00 GMT", m_rq->srvhdrs); + pblock_nvinsert("cache-control", "private,no-store,no-cache", m_rq->srvhdrs); + pblock_nvinsert("location", url, m_rq->srvhdrs); + pblock_nvinsert("connection","close",m_rq->srvhdrs); + protocol_status(m_sn, m_rq, PROTOCOL_REDIRECT, NULL); protocol_start_response(m_sn, m_rq); - char* msg="Redirecting..."; - net_write(m_sn->csd,msg,strlen(msg)); - return (void*)REQ_EXIT; + return REQ_ABORTED; + } + long returnDecline() { return REQ_NOACTION; } + long returnOK() { return REQ_PROCEED; } + const vector& getClientCertificates() const { + if (m_certs.empty()) { + const char* cert = pblock_findval("auth-cert", m_rq->vars); + if (cert) + m_certs.push_back(cert); + } + return m_certs; } - virtual void* returnDecline(void) { return (void*)REQ_NOACTION; } - virtual void* returnOK(void) { return (void*)REQ_PROCEED; } - - pblock* m_pb; - Session* m_sn; - Request* m_rq; }; /********************************************************************************/ -int WriteClientError(Session* sn, Request* rq, char* func, char* msg) +int WriteClientError(::Session* sn, Request* rq, char* func, char* msg) { log_error(LOG_FAILURE,func,sn,rq,msg); protocol_status(sn,rq,PROTOCOL_SERVER_ERROR,msg); @@ -349,130 +391,129 @@ int WriteClientError(Session* sn, Request* rq, char* func, char* msg) #undef FUNC #define FUNC "shibboleth" -extern "C" NSAPI_PUBLIC int nsapi_shib(pblock* pb, Session* sn, Request* rq) +extern "C" NSAPI_PUBLIC int nsapi_shib(pblock* pb, ::Session* sn, Request* rq) { ostringstream threadid; threadid << "[" << getpid() << "] nsapi_shib" << '\0'; - saml::NDC ndc(threadid.str().c_str()); + xmltooling::NDC ndc(threadid.str().c_str()); -#ifndef _DEBUG try { -#endif ShibTargetNSAPI stn(pb, sn, rq); // Check user authentication - pair res = stn.doCheckAuthN(); + pair res = stn.getServiceProvider().doAuthentication(stn); if (res.first) return (int)res.second; // user authN was okay -- export the assertions now - /* - const char* param=pblock_findval("export-assertion", pb); - bool doExportAssn = false; - if (param && (!strcmp(param,"1") || !strcasecmp(param,"true"))) - doExportAssn = true; - */ - res = stn.doExportAssertions(); + param_free(pblock_remove("auth-user",rq->vars)); + // This seems to be required in order to eventually set + // the auth-user var. + pblock_nvinsert("auth-type","shibboleth",rq->vars); + res = stn.getServiceProvider().doExport(stn); if (res.first) return (int)res.second; // Check the Authorization - res = stn.doCheckAuthZ(); + res = stn.getServiceProvider().doAuthorization(stn); if (res.first) return (int)res.second; // this user is ok. return REQ_PROCEED; - -#ifndef _DEBUG + } + catch (exception& e) { + log_error(LOG_FAILURE,FUNC,sn,rq,const_cast(e.what())); + return WriteClientError(sn, rq, FUNC, "Shibboleth module threw an exception, see web server log for error."); } catch (...) { - return WriteClientError(sn, rq, FUNC, "threw an uncaught exception."); + log_error(LOG_FAILURE,FUNC,sn,rq,const_cast("Shibboleth module threw an unknown exception.")); + if (g_catchAll) + return WriteClientError(sn, rq, FUNC, "Shibboleth module threw an unknown exception."); + throw; } -#endif } #undef FUNC #define FUNC "shib_handler" -extern "C" NSAPI_PUBLIC int shib_handler(pblock* pb, Session* sn, Request* rq) +extern "C" NSAPI_PUBLIC int shib_handler(pblock* pb, ::Session* sn, Request* rq) { ostringstream threadid; threadid << "[" << getpid() << "] shib_handler" << '\0'; - saml::NDC ndc(threadid.str().c_str()); + xmltooling::NDC ndc(threadid.str().c_str()); -#ifndef _DEBUG try { -#endif ShibTargetNSAPI stn(pb, sn, rq); - pair res = stn.doHandler(); + pair res = stn.getServiceProvider().doHandler(stn); if (res.first) return (int)res.second; return WriteClientError(sn, rq, FUNC, "Shibboleth handler did not do anything."); - -#ifndef _DEBUG + } + catch (exception& e) { + log_error(LOG_FAILURE,FUNC,sn,rq,const_cast(e.what())); + return WriteClientError(sn, rq, FUNC, "Shibboleth handler threw an exception, see web server log for error."); } catch (...) { - return WriteClientError(sn, rq, FUNC, "Filter threw an unknown exception."); + if (g_catchAll) + return WriteClientError(sn, rq, FUNC, "Shibboleth handler threw an unknown exception."); + throw; } -#endif } -class SunRequestMapper : public virtual IRequestMapper, public virtual IPropertySet +class SunRequestMapper : public virtual RequestMapper, public virtual PropertySet { public: - SunRequestMapper(const DOMElement* e); + SunRequestMapper(const xercesc::DOMElement* e); ~SunRequestMapper() { delete m_mapper; delete m_stKey; delete m_propsKey; } - void lock() { m_mapper->lock(); } + Lockable* lock() { return m_mapper->lock(); } void unlock() { m_stKey->setData(NULL); m_propsKey->setData(NULL); m_mapper->unlock(); } - Settings getSettings(ShibTarget* st) const; + Settings getSettings(const HTTPRequest& request) const; + const PropertySet* getParent() const { return NULL; } + void setParent(const PropertySet*) {} pair getBool(const char* name, const char* ns=NULL) const; pair getString(const char* name, const char* ns=NULL) const; pair getXMLString(const char* name, const char* ns=NULL) const; pair getUnsignedInt(const char* name, const char* ns=NULL) const; pair getInt(const char* name, const char* ns=NULL) const; - const IPropertySet* getPropertySet(const char* name, const char* ns="urn:mace:shibboleth:target:config:1.0") const; - const DOMElement* getElement() const; + void getAll(map& properties) const; + const PropertySet* getPropertySet(const char* name, const char* ns=shibspconstants::ASCII_SHIB2SPCONFIG_NS) const; + const xercesc::DOMElement* getElement() const; private: - IRequestMapper* m_mapper; + RequestMapper* m_mapper; ThreadKey* m_stKey; ThreadKey* m_propsKey; }; -IPlugIn* SunRequestMapFactory(const DOMElement* e) +RequestMapper* SunRequestMapFactory(const xercesc::DOMElement* const & e) { return new SunRequestMapper(e); } -SunRequestMapper::SunRequestMapper(const DOMElement* e) : m_mapper(NULL), m_stKey(NULL), m_propsKey(NULL) +SunRequestMapper::SunRequestMapper(const xercesc::DOMElement* e) : m_mapper(NULL), m_stKey(NULL), m_propsKey(NULL) { - IPlugIn* p=SAMLConfig::getConfig().getPlugMgr().newPlugin(shibtarget::XML::XMLRequestMapType,e); - m_mapper=dynamic_cast(p); - if (!m_mapper) { - delete p; - throw UnsupportedExtensionException("Embedded request mapper plugin was not of correct type."); - } + m_mapper = SPConfig::getConfig().RequestMapperManager.newPlugin(XML_REQUEST_MAPPER,e); m_stKey=ThreadKey::create(NULL); m_propsKey=ThreadKey::create(NULL); } -IRequestMapper::Settings SunRequestMapper::getSettings(ShibTarget* st) const +RequestMapper::Settings SunRequestMapper::getSettings(const HTTPRequest& request) const { - Settings s=m_mapper->getSettings(st); - m_stKey->setData(dynamic_cast(st)); + Settings s=m_mapper->getSettings(request); + m_stKey->setData((void*)dynamic_cast(&request)); m_propsKey->setData((void*)s.first); - return pair(this,s.second); + return pair(this,s.second); } pair SunRequestMapper::getBool(const char* name, const char* ns) const { - ShibTargetNSAPI* stn=reinterpret_cast(m_stKey->getData()); - const IPropertySet* s=reinterpret_cast(m_propsKey->getData()); + const ShibTargetNSAPI* stn=reinterpret_cast(m_stKey->getData()); + const PropertySet* s=reinterpret_cast(m_propsKey->getData()); if (stn && !ns && name) { // Override boolean properties. const char* param=pblock_findval(name,stn->m_pb); - if (param && (!strcmp(param,"1") || !util_strcasecmp(param,"true"))) + if (param && (!strcmp(param,"1") || !strcasecmp(param,"true"))) return make_pair(true,true); } return s ? s->getBool(name,ns) : make_pair(false,false); @@ -480,8 +521,8 @@ pair SunRequestMapper::getBool(const char* name, const char* ns) cons pair SunRequestMapper::getString(const char* name, const char* ns) const { - ShibTargetNSAPI* stn=reinterpret_cast(m_stKey->getData()); - const IPropertySet* s=reinterpret_cast(m_propsKey->getData()); + const ShibTargetNSAPI* stn=reinterpret_cast(m_stKey->getData()); + const PropertySet* s=reinterpret_cast(m_propsKey->getData()); if (stn && !ns && name) { // Override string properties. if (!strcmp(name,"authType")) @@ -497,663 +538,63 @@ pair SunRequestMapper::getString(const char* name, const char* pair SunRequestMapper::getXMLString(const char* name, const char* ns) const { - const IPropertySet* s=reinterpret_cast(m_propsKey->getData()); + const PropertySet* s=reinterpret_cast(m_propsKey->getData()); return s ? s->getXMLString(name,ns) : pair(false,NULL); } pair SunRequestMapper::getUnsignedInt(const char* name, const char* ns) const { - const IPropertySet* s=reinterpret_cast(m_propsKey->getData()); - return s ? s->getUnsignedInt(name,ns) : make_pair(false,0); -} - -pair SunRequestMapper::getInt(const char* name, const char* ns) const -{ - const IPropertySet* s=reinterpret_cast(m_propsKey->getData()); - return s ? s->getInt(name,ns) : make_pair(false,0); -} - -const IPropertySet* SunRequestMapper::getPropertySet(const char* name, const char* ns) const -{ - const IPropertySet* s=reinterpret_cast(m_propsKey->getData()); - return s ? s->getPropertySet(name,ns) : NULL; -} - -const DOMElement* SunRequestMapper::getElement() const -{ - const IPropertySet* s=reinterpret_cast(m_propsKey->getData()); - return s ? s->getElement() : NULL; -} - - -#if 0 - -IRequestMapper::Settings map_request(pblock* pb, Session* sn, Request* rq, IRequestMapper* mapper, string& target) -{ - // Get everything but hostname... - const char* uri=pblock_findval("uri",rq->reqpb); - const char* qstr=pblock_findval("query",rq->reqpb); - int port=server_portnum; - const char* scheme=security_active ? "https" : "http"; - const char* host=NULL; - - string url; - if (uri) - url=uri; - if (qstr) - url=url + '?' + qstr; - -#ifdef vs_is_default_vs - // This is 6.0 or later, so we can distinguish requests to name-based vhosts. - if (!vs_is_default_vs) - // The beauty here is, a non-default vhost can *only* be accessed if the client - // specified the exact name in the Host header. So we can trust the Host header. - host=pblock_findval("host", rq->headers); - else -#endif - // In other cases, we're going to rely on the initialization process... - host=g_ServerName.c_str(); - - target=(g_ServerScheme.empty() ? string(scheme) : g_ServerScheme) + "://" + host; - - // If port is non-default, append it. - if ((!security_active && port!=80) || (security_active && port!=443)) { - char portbuf[10]; - util_snprintf(portbuf,9,"%d",port); - target = target + ':' + portbuf; + const ShibTargetNSAPI* stn=reinterpret_cast(m_stKey->getData()); + const PropertySet* s=reinterpret_cast(m_propsKey->getData()); + if (stn && !ns && name) { + // Override int properties. + const char* param=pblock_findval(name,stn->m_pb); + if (param) + return pair(true,strtol(param,NULL,10)); } - - target+=url; - - return mapper->getSettingsFromParsedURL(scheme,host,port,url.c_str()); + return s ? s->getUnsignedInt(name,ns) : pair(false,0); } -int WriteClientError(Session* sn, Request* rq, const IApplication* app, const char* page, ShibMLP& mlp) +pair SunRequestMapper::getInt(const char* name, const char* ns) const { - const IPropertySet* props=app->getPropertySet("Errors"); - if (props) { - pair p=props->getString(page); - if (p.first) { - ifstream infile(p.second); - if (!infile.fail()) { - const char* res = mlp.run(infile,props); - if (res) { - pblock_nvinsert("Content-Type","text/html",rq->srvhdrs); - pblock_nninsert("Content-Length",strlen(res),rq->srvhdrs); - pblock_nvinsert("Connection","close",rq->srvhdrs); - protocol_status(sn,rq,PROTOCOL_OK,NULL); - NET_WRITE(const_cast(res)); - return REQ_EXIT; - } - } - } + const ShibTargetNSAPI* stn=reinterpret_cast(m_stKey->getData()); + const PropertySet* s=reinterpret_cast(m_propsKey->getData()); + if (stn && !ns && name) { + // Override int properties. + const char* param=pblock_findval(name,stn->m_pb); + if (param) + return pair(true,atoi(param)); } - - log_error(LOG_FAILURE,"WriteClientError",sn,rq,"Unable to open error template, check settings."); - protocol_status(sn,rq,PROTOCOL_SERVER_ERROR,"Unable to open error template, check settings."); - return REQ_ABORTED; + return s ? s->getInt(name,ns) : pair(false,0); } -int WriteRedirectPage(Session* sn, Request* rq, const IApplication* app, const char* file, ShibMLP& mlp) +void SunRequestMapper::getAll(map& properties) const { - ifstream infile(file); - if (!infile.fail()) { - const char* res = mlp.run(infile,app->getPropertySet("Errors")); - if (res) { - pblock_nvinsert("Content-Type","text/html",rq->srvhdrs); - pblock_nninsert("Content-Length",strlen(res),rq->srvhdrs); - protocol_status(sn,rq,PROTOCOL_OK,NULL); - NET_WRITE(const_cast(res)); - return REQ_EXIT; + const ShibTargetNSAPI* stn=reinterpret_cast(m_stKey->getData()); + const PropertySet* s=reinterpret_cast(m_propsKey->getData()); + if (s) + s->getAll(properties); + if (!stn) + return; + properties["authType"] = "shibboleth"; + const pb_entry* entry; + for (int i=0; im_pb->hsize; ++i) { + entry = stn->m_pb->ht[i]; + while (entry) { + properties[entry->param->name] = entry->param->value; + entry = entry->next; } } - log_error(LOG_FAILURE,"WriteRedirectPage",sn,rq,"Unable to open redirect template, check settings."); - protocol_status(sn,rq,PROTOCOL_SERVER_ERROR,"Unable to open redirect template, check settings."); - return REQ_ABORTED; } -#undef FUNC -#define FUNC "shibboleth" -extern "C" NSAPI_PUBLIC int nsapi_shib(pblock* pb, Session* sn, Request* rq) +const PropertySet* SunRequestMapper::getPropertySet(const char* name, const char* ns) const { - try - { - ostringstream threadid; - threadid << "[" << getpid() << "] nsapi_shib" << '\0'; - saml::NDC ndc(threadid.str().c_str()); - - // We lock the configuration system for the duration. - IConfig* conf=g_Config->getINI(); - Locker locker(conf); - - // Map request to application and content settings. - string targeturl; - IRequestMapper* mapper=conf->getRequestMapper(); - Locker locker2(mapper); - IRequestMapper::Settings settings=map_request(pb,sn,rq,mapper,targeturl); - pair application_id=settings.first->getString("applicationId"); - const IApplication* application=conf->getApplication(application_id.second); - if (!application) - return WriteClientError(sn,rq,FUNC,"Unable to map request to application settings, check configuration."); - - // Declare SHIRE object for this request. - SHIRE shire(application); - - const char* shireURL=shire.getShireURL(targeturl.c_str()); - if (!shireURL) - return WriteClientError(sn,rq,FUNC,"Unable to map request to proper shireURL setting, check configuration."); - - // If the user is accessing the SHIRE acceptance point, pass it on. - if (targeturl.find(shireURL)!=string::npos) - return REQ_PROCEED; - - // Now check the policy for this request. - pair requireSession=settings.first->getBool("requireSession"); - if (!requireSession.first || !requireSession.second) { - const char* param=pblock_findval("require-session",pb); - if (param && (!strcmp(param,"1") || !strcasecmp(param,"true"))) - requireSession.second=true; - } - pair shib_cookie=shire.getCookieNameProps(); - pair httpRedirects=application->getPropertySet("Sessions")->getBool("httpRedirects"); - pair redirectPage=application->getPropertySet("Sessions")->getString("redirectPage"); - if (httpRedirects.first && !httpRedirects.second && !redirectPage.first) - return WriteClientError(sn,rq,FUNC,"HTML-based redirection requires a redirectPage property."); - - // Check for session cookie. - const char* session_id=NULL; - string cookie; - if (request_header("cookie",(char**)&session_id,sn,rq)==REQ_ABORTED) - return WriteClientError(sn,rq,FUNC,"error accessing cookie header"); - - Category::getInstance("nsapi_shib."FUNC).debug("cookie header is {%s}",session_id ? session_id : "NULL"); - if (session_id && (session_id=strstr(session_id,shib_cookie.first))) { - session_id+=strlen(shib_cookie.first) + 1; /* Skip over the '=' */ - char* cookieend=strchr(session_id,';'); - if (cookieend) { - // Chop out just the value portion. - cookie.assign(session_id,cookieend-session_id-1); - session_id=cookie.c_str(); - } - } - - if (!session_id || !*session_id) { - // If no session required, bail now. - if (!requireSession.second) - return REQ_PROCEED; - - // No acceptable cookie, and we require a session. Generate an AuthnRequest. - const char* areq = shire.getAuthnRequest(targeturl.c_str()); - if (!httpRedirects.first || httpRedirects.second) { - pblock_nvinsert("Content-Type","text/html",rq->srvhdrs); - pblock_nvinsert("Content-Length","40",rq->srvhdrs); - pblock_nvinsert("Expires","01-Jan-1997 12:00:00 GMT",rq->srvhdrs); - pblock_nvinsert("Cache-Control","private,no-store,no-cache",rq->srvhdrs); - pblock_nvinsert("Location",areq,rq->srvhdrs); - protocol_status(sn,rq,PROTOCOL_REDIRECT,"302 Please wait"); - protocol_start_response(sn,rq); - NET_WRITE("Redirecting..."); - return REQ_EXIT; - } - else { - ShibMLP markupProcessor; - markupProcessor.insert("requestURL",areq); - return WriteRedirectPage(sn, rq, application, redirectPage.second, markupProcessor); - } - } - - // Make sure this session is still valid. - RPCError* status = NULL; - ShibMLP markupProcessor; - markupProcessor.insert("requestURL", targeturl); - - try { - status = shire.sessionIsValid(session_id, pblock_findval("ip",sn->client)); - } - catch (ShibTargetException &e) { - markupProcessor.insert("errorType", "Session Processing Error"); - markupProcessor.insert("errorText", e.what()); - markupProcessor.insert("errorDesc", "An error occurred while processing your request."); - return WriteClientError(sn, rq, application, "shire", markupProcessor); - } -#ifndef _DEBUG - catch (...) { - markupProcessor.insert("errorType", "Session Processing Error"); - markupProcessor.insert("errorText", "Unexpected Exception"); - markupProcessor.insert("errorDesc", "An error occurred while processing your request."); - return WriteClientError(sn, rq, application, "shire", markupProcessor); - } -#endif - - // Check the status - if (status->isError()) { - if (!requireSession.second) - return REQ_PROCEED; - else if (status->isRetryable()) { - // Oops, session is invalid. Generate AuthnRequest. - delete status; - const char* areq = shire.getAuthnRequest(targeturl.c_str()); - if (!httpRedirects.first || httpRedirects.second) { - pblock_nvinsert("Content-Type","text/html",rq->srvhdrs); - pblock_nvinsert("Content-Length","40",rq->srvhdrs); - pblock_nvinsert("Expires","01-Jan-1997 12:00:00 GMT",rq->srvhdrs); - pblock_nvinsert("Cache-Control","private,no-store,no-cache",rq->srvhdrs); - pblock_nvinsert("Location",areq,rq->srvhdrs); - protocol_status(sn,rq,PROTOCOL_REDIRECT,"302 Please wait"); - protocol_start_response(sn,rq); - NET_WRITE("Redirecting..."); - return REQ_EXIT; - } - else { - markupProcessor.insert("requestURL",areq); - return WriteRedirectPage(sn, rq, application, redirectPage.second, markupProcessor); - } - } - else { - // return the error page to the user - markupProcessor.insert(*status); - delete status; - return WriteClientError(sn, rq, application, "shire", markupProcessor); - } - } - delete status; - - // Move to RM phase. - RM rm(application); - vector assertions; - SAMLAuthenticationStatement* sso_statement=NULL; - - try { - status = rm.getAssertions(session_id, pblock_findval("ip",sn->client), assertions, &sso_statement); - } - catch (ShibTargetException &e) { - markupProcessor.insert("errorType", "Attribute Processing Error"); - markupProcessor.insert("errorText", e.what()); - markupProcessor.insert("errorDesc", "An error occurred while processing your request."); - return WriteClientError(sn, rq, application, "rm", markupProcessor); - } - #ifndef _DEBUG - catch (...) { - markupProcessor.insert("errorType", "Attribute Processing Error"); - markupProcessor.insert("errorText", "Unexpected Exception"); - markupProcessor.insert("errorDesc", "An error occurred while processing your request."); - return WriteClientError(sn, rq, application, "rm", markupProcessor); - } - #endif - - if (status->isError()) { - markupProcessor.insert(*status); - delete status; - return WriteClientError(sn, rq, application, "rm", markupProcessor); - } - delete status; - - // Do we have an access control plugin? - if (settings.second) { - Locker acllock(settings.second); - if (!settings.second->authorized(*sso_statement,assertions)) { - for (int k = 0; k < assertions.size(); k++) - delete assertions[k]; - delete sso_statement; - return WriteClientError(sn, rq, application, "access", markupProcessor); - } - } - - // Get the AAP providers, which contain the attribute policy info. - Iterator provs=application->getAAPProviders(); - - // Clear out the list of mapped attributes - while (provs.hasNext()) { - IAAP* aap=provs.next(); - aap->lock(); - try { - Iterator rules=aap->getAttributeRules(); - while (rules.hasNext()) { - const char* header=rules.next()->getHeader(); - if (header) - param_free(pblock_remove(header,rq->headers)); - } - } - catch(...) { - aap->unlock(); - for (int k = 0; k < assertions.size(); k++) - delete assertions[k]; - delete sso_statement; - markupProcessor.insert("errorType", "Attribute Processing Error"); - markupProcessor.insert("errorText", "Unexpected Exception"); - markupProcessor.insert("errorDesc", "An error occurred while processing your request."); - return WriteClientError(sn, rq, application, "rm", markupProcessor); - } - aap->unlock(); - } - provs.reset(); - - // Maybe export the first assertion. - param_free(pblock_remove("remote-user",rq->headers)); - param_free(pblock_remove("auth-user",rq->vars)); - param_free(pblock_remove("Shib-Attributes",rq->headers)); - pair exp=settings.first->getBool("exportAssertion"); - if (!exp.first || !exp.second) { - const char* param=pblock_findval("export-assertion",pb); - if (param && (!strcmp(param,"1") || !strcasecmp(param,"true"))) - exp.second=true; - } - if (exp.second && assertions.size()) { - string assertion; - RM::serialize(*(assertions[0]), assertion); - string::size_type lfeed; - while ((lfeed=assertion.find('\n'))!=string::npos) - assertion.erase(lfeed,1); - pblock_nvinsert("Shib-Attributes",assertion.c_str(),rq->headers); - } - - pblock_nvinsert("auth-type","shibboleth",rq->vars); - param_free(pblock_remove("Shib-Origin-Site",rq->headers)); - param_free(pblock_remove("Shib-Authentication-Method",rq->headers)); - param_free(pblock_remove("Shib-NameIdentifier-Format",rq->headers)); - - // Export the SAML AuthnMethod and the origin site name. - auto_ptr_char os(sso_statement->getSubject()->getNameIdentifier()->getNameQualifier()); - auto_ptr_char am(sso_statement->getAuthMethod()); - pblock_nvinsert("Shib-Origin-Site",os.get(),rq->headers); - pblock_nvinsert("Shib-Authentication-Method",am.get(),rq->headers); - - // Export NameID? - AAP wrapper(provs,sso_statement->getSubject()->getNameIdentifier()->getFormat(),Constants::SHIB_ATTRIBUTE_NAMESPACE_URI); - if (!wrapper.fail() && wrapper->getHeader()) { - auto_ptr_char form(sso_statement->getSubject()->getNameIdentifier()->getFormat()); - auto_ptr_char nameid(sso_statement->getSubject()->getNameIdentifier()->getName()); - pblock_nvinsert("Shib-NameIdentifier-Format",form.get(),pb); - if (!strcmp(wrapper->getHeader(),"REMOTE_USER")) { - pblock_nvinsert("remote-user",nameid.get(),rq->headers); - pblock_nvinsert("auth-user",nameid.get(),rq->vars); - } - else { - pblock_nvinsert(wrapper->getHeader(),nameid.get(),rq->headers); - } - } - - param_free(pblock_remove("Shib-Application-ID",rq->headers)); - pblock_nvinsert("Shib-Application-ID",application_id.second,rq->headers); - - // Export the attributes. - Iterator a_iter(assertions); - while (a_iter.hasNext()) { - SAMLAssertion* assert=a_iter.next(); - Iterator statements=assert->getStatements(); - while (statements.hasNext()) { - SAMLAttributeStatement* astate=dynamic_cast(statements.next()); - if (!astate) - continue; - Iterator attrs=astate->getAttributes(); - while (attrs.hasNext()) { - SAMLAttribute* attr=attrs.next(); - - // Are we supposed to export it? - AAP wrapper(provs,attr->getName(),attr->getNamespace()); - if (wrapper.fail() || !wrapper->getHeader()) - continue; - - Iterator vals=attr->getSingleByteValues(); - if (!strcmp(wrapper->getHeader(),"REMOTE_USER") && vals.hasNext()) { - char* principal=const_cast(vals.next().c_str()); - pblock_nvinsert("remote-user",principal,rq->headers); - pblock_nvinsert("auth-user",principal,rq->vars); - } - else { - int it=0; - string header; - const char* h=pblock_findval(wrapper->getHeader(),rq->headers); - if (h) { - header=h; - param_free(pblock_remove(wrapper->getHeader(),rq->headers)); - it++; - } - for (; vals.hasNext(); it++) { - string value = vals.next(); - for (string::size_type pos = value.find_first_of(";", string::size_type(0)); - pos != string::npos; - pos = value.find_first_of(";", pos)) { - value.insert(pos, "\\"); - pos += 2; - } - if (it == 0) - header=value; - else - header=header + ';' + value; - } - pblock_nvinsert(wrapper->getHeader(),header.c_str(),rq->headers); - } - } - } - } - - // clean up memory - for (int k = 0; k < assertions.size(); k++) - delete assertions[k]; - delete sso_statement; - - return REQ_PROCEED; - } - catch(bad_alloc) { - return WriteClientError(sn, rq, FUNC,"Out of Memory"); - } -#ifndef _DEBUG - catch(...) { - return WriteClientError(sn, rq, FUNC,"Server caught an unknown exception."); - } -#endif - - return WriteClientError(sn, rq, FUNC,"Server reached unreachable code, save my walrus!"); + const PropertySet* s=reinterpret_cast(m_propsKey->getData()); + return s ? s->getPropertySet(name,ns) : NULL; } -#undef FUNC -#define FUNC "shib_handler" -extern "C" NSAPI_PUBLIC int shib_handler(pblock* pb, Session* sn, Request* rq) +const xercesc::DOMElement* SunRequestMapper::getElement() const { - string targeturl; - const IApplication* application=NULL; - try - { - ostringstream threadid; - threadid << "[" << getpid() << "] shib_handler" << '\0'; - saml::NDC ndc(threadid.str().c_str()); - - // We lock the configuration system for the duration. - IConfig* conf=g_Config->getINI(); - Locker locker(conf); - - // Map request to application and content settings. - IRequestMapper* mapper=conf->getRequestMapper(); - Locker locker2(mapper); - IRequestMapper::Settings settings=map_request(pb,sn,rq,mapper,targeturl); - pair application_id=settings.first->getString("applicationId"); - application=conf->getApplication(application_id.second); - const IPropertySet* sessionProps=application ? application->getPropertySet("Sessions") : NULL; - if (!application || !sessionProps) - return WriteClientError(sn,rq,FUNC,"Unable to map request to application settings, check configuration."); - - SHIRE shire(application); - - const char* shireURL=shire.getShireURL(targeturl.c_str()); - if (!shireURL) - return WriteClientError(sn,rq,FUNC,"Unable to map request to proper shireURL setting, check configuration."); - - // Make sure we only process the SHIRE requests. - if (!strstr(targeturl.c_str(),shireURL)) - return WriteClientError(sn,rq,FUNC,"NSAPI service function can only be invoked to process incoming sessions." - "Make sure the mapped file extension or URL doesn't match actual content."); - - pair shib_cookie=shire.getCookieNameProps(); - - // Make sure this is SSL, if it should be - pair shireSSL=sessionProps->getBool("shireSSL"); - if (!shireSSL.first || shireSSL.second) { - if (!security_active) - throw ShibTargetException(SHIBRPC_OK,"blocked non-SSL access to Shibboleth session processor"); - } - - pair httpRedirects=sessionProps->getBool("httpRedirects"); - pair redirectPage=sessionProps->getString("redirectPage"); - if (httpRedirects.first && !httpRedirects.second && !redirectPage.first) - return WriteClientError(sn,rq,FUNC,"HTML-based redirection requires a redirectPage property."); - - // If this is a GET, we manufacture an AuthnRequest. - if (!strcasecmp(pblock_findval("method",rq->reqpb),"GET")) { - const char* areq=pblock_findval("query",rq->reqpb) ? shire.getLazyAuthnRequest(pblock_findval("query",rq->reqpb)) : NULL; - if (!areq) - throw ShibTargetException(SHIBRPC_OK, "malformed arguments to request a new session"); - if (!httpRedirects.first || httpRedirects.second) { - pblock_nvinsert("Content-Type","text/html",rq->srvhdrs); - pblock_nvinsert("Content-Length","40",rq->srvhdrs); - pblock_nvinsert("Expires","01-Jan-1997 12:00:00 GMT",rq->srvhdrs); - pblock_nvinsert("Cache-Control","private,no-store,no-cache",rq->srvhdrs); - pblock_nvinsert("Location",areq,rq->srvhdrs); - protocol_status(sn,rq,PROTOCOL_REDIRECT,"302 Please wait"); - protocol_start_response(sn,rq); - NET_WRITE("Redirecting..."); - return REQ_EXIT; - } - else { - ShibMLP markupProcessor; - markupProcessor.insert("requestURL",areq); - return WriteRedirectPage(sn, rq, application, redirectPage.second, markupProcessor); - } - } - else if (strcasecmp(pblock_findval("method",rq->reqpb),"POST")) - throw ShibTargetException(SHIBRPC_OK,"blocked non-POST to Shibboleth session processor"); - - // Make sure this POST is an appropriate content type - char* content_type=NULL; - if (request_header("content-type",&content_type,sn,rq)!=REQ_PROCEED || - !content_type || strcasecmp(content_type,"application/x-www-form-urlencoded")) - throw ShibTargetException(SHIBRPC_OK,"blocked bad content-type to Shibboleth session processor"); - - // Read the data. - pair elements=pair(NULL,NULL); - char* content_length=NULL; - if (request_header("content-length",&content_length,sn,rq)!=REQ_PROCEED || - atoi(content_length) > 1024*1024) // 1MB? - throw ShibTargetException(SHIBRPC_OK,"blocked too-large a post to Shibboleth session processor"); - else { - char ch=IO_EOF+1; - int cl=atoi(content_length); - string cgistr; - while (cl && ch!=IO_EOF) { - ch=netbuf_getc(sn->inbuf); - - // Check for error. - if(ch==IO_ERROR) - break; - cgistr+=ch; - cl--; - } - if (cl) - throw ShibTargetException(SHIBRPC_OK,"error reading POST data from browser"); - elements=shire.getFormSubmission(cgistr.c_str(),cgistr.length()); - } - - // Make sure the SAML Response parameter exists - if (!elements.first || !*elements.first) - throw ShibTargetException(SHIBRPC_OK, "Shibboleth POST failed to find SAMLResponse form element"); - - // Make sure the target parameter exists - if (!elements.second || !*elements.second) - throw ShibTargetException(SHIBRPC_OK, "Shibboleth POST failed to find TARGET form element"); - - // Process the post. - string cookie; - RPCError* status=NULL; - ShibMLP markupProcessor; - markupProcessor.insert("requestURL", targeturl.c_str()); - try { - status = shire.sessionCreate(elements.first,pblock_findval("ip",sn->client),cookie); - } - catch (ShibTargetException &e) { - markupProcessor.insert("errorType", "Session Creation Service Error"); - markupProcessor.insert("errorText", e.what()); - markupProcessor.insert("errorDesc", "An error occurred while processing your request."); - return WriteClientError(sn, rq, application, "shire", markupProcessor); - } -#ifndef _DEBUG - catch (...) { - markupProcessor.insert("errorType", "Session Creation Service Error"); - markupProcessor.insert("errorText", "Unexpected Exception"); - markupProcessor.insert("errorDesc", "An error occurred while processing your request."); - return WriteClientError(sn, rq, application, "shire", markupProcessor); - } -#endif - - if (status->isError()) { - if (status->isRetryable()) { - delete status; - const char* loc=shire.getAuthnRequest(elements.second); - if (!httpRedirects.first || httpRedirects.second) { - pblock_nvinsert("Content-Type","text/html",rq->srvhdrs); - pblock_nvinsert("Content-Length","40",rq->srvhdrs); - pblock_nvinsert("Expires","01-Jan-1997 12:00:00 GMT",rq->srvhdrs); - pblock_nvinsert("Cache-Control","private,no-store,no-cache",rq->srvhdrs); - pblock_nvinsert("Location",loc,rq->srvhdrs); - protocol_status(sn,rq,PROTOCOL_REDIRECT,"302 Please wait"); - protocol_start_response(sn,rq); - NET_WRITE("Redirecting..."); - return REQ_EXIT; - } - else { - markupProcessor.insert("requestURL",loc); - return WriteRedirectPage(sn, rq, application, redirectPage.second, markupProcessor); - } - } - - // Return this error to the user. - markupProcessor.insert(*status); - delete status; - return WriteClientError(sn,rq,application,"shire",markupProcessor); - } - delete status; - - // We've got a good session, set the cookie and redirect to target. - cookie = string(shib_cookie.first) + '=' + cookie + shib_cookie.second; - pblock_nvinsert("Set-Cookie",cookie.c_str(),rq->srvhdrs); - if (!httpRedirects.first || httpRedirects.second) { - pblock_nvinsert("Content-Type","text/html",rq->srvhdrs); - pblock_nvinsert("Content-Length","40",rq->srvhdrs); - pblock_nvinsert("Expires","01-Jan-1997 12:00:00 GMT",rq->srvhdrs); - pblock_nvinsert("Cache-Control","private,no-store,no-cache",rq->srvhdrs); - pblock_nvinsert("Location",elements.second,rq->srvhdrs); - protocol_status(sn,rq,PROTOCOL_REDIRECT,"302 Please wait"); - protocol_start_response(sn,rq); - NET_WRITE("Redirecting..."); - return REQ_EXIT; - } - else { - markupProcessor.insert("requestURL",elements.second); - return WriteRedirectPage(sn, rq, application, redirectPage.second, markupProcessor); - } - } - catch (ShibTargetException &e) { - if (application) { - ShibMLP markupProcessor; - markupProcessor.insert("requestURL", targeturl.c_str()); - markupProcessor.insert("errorType", "Session Creation Service Error"); - markupProcessor.insert("errorText", e.what()); - markupProcessor.insert("errorDesc", "An error occurred while processing your request."); - return WriteClientError(sn,rq,application,"shire",markupProcessor); - } - } -#ifndef _DEBUG - catch (...) { - if (application) { - ShibMLP markupProcessor; - markupProcessor.insert("requestURL", targeturl.c_str()); - markupProcessor.insert("errorType", "Session Creation Service Error"); - markupProcessor.insert("errorText", "Unexpected Exception"); - markupProcessor.insert("errorDesc", "An error occurred while processing your request."); - return WriteClientError(sn,rq,application,"shire",markupProcessor); - } - } -#endif - return REQ_EXIT; + const PropertySet* s=reinterpret_cast(m_propsKey->getData()); + return s ? s->getElement() : NULL; } - -#endif