X-Git-Url: http://www.project-moonshot.org/gitweb/?a=blobdiff_plain;f=saml%2Fsaml2%2Fbinding%2Fimpl%2FSAML2ArtifactDecoder.cpp;h=32ca0f4f050136fafaf08750f683333b6b291c6c;hb=40fdf576ed07e3cf8f88d9bf0441e55ea4fc3d05;hp=846254a7f3d529ddd007b7b784f3e42491c42e01;hpb=c0b92549e28e1fca5e7c4a8d09dc06fd09f65292;p=shibboleth%2Fcpp-opensaml.git diff --git a/saml/saml2/binding/impl/SAML2ArtifactDecoder.cpp b/saml/saml2/binding/impl/SAML2ArtifactDecoder.cpp index 846254a..32ca0f4 100644 --- a/saml/saml2/binding/impl/SAML2ArtifactDecoder.cpp +++ b/saml/saml2/binding/impl/SAML2ArtifactDecoder.cpp @@ -1,6 +1,6 @@ /* - * Copyright 2001-2006 Internet2 - * + * Copyright 2001-2010 Internet2 + * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at @@ -16,21 +16,22 @@ /** * SAML2ArtifactDecoder.cpp - * - * SAML 2.0 Artifact binding message decoder + * + * SAML 2.0 Artifact binding message decoder. */ #include "internal.h" #include "exceptions.h" -#include "saml/binding/SAMLArtifact.h" +#include "binding/SecurityPolicy.h" +#include "saml2/binding/SAML2Artifact.h" +#include "saml2/binding/SAML2MessageDecoder.h" #include "saml2/core/Protocols.h" #include "saml2/metadata/Metadata.h" #include "saml2/metadata/MetadataProvider.h" -#include "saml2/binding/SAML2Artifact.h" -#include "saml2/binding/SAML2ArtifactDecoder.h" -#include "security/X509TrustEngine.h" -#include +#include +#include +#include #include #include @@ -38,32 +39,40 @@ using namespace opensaml::saml2md; using namespace opensaml::saml2p; using namespace opensaml::saml2; using namespace opensaml; -using namespace xmlsignature; +using namespace xmltooling::logging; using namespace xmltooling; -using namespace log4cpp; using namespace std; namespace opensaml { - namespace saml2p { - MessageDecoder* SAML_DLLLOCAL SAML2ArtifactDecoderFactory(const DOMElement* const & e) + namespace saml2p { + class SAML_DLLLOCAL SAML2ArtifactDecoder : public SAML2MessageDecoder + { + public: + SAML2ArtifactDecoder() {} + virtual ~SAML2ArtifactDecoder() {} + + const char* getShortName() const { + return "Artifact"; + } + + xmltooling::XMLObject* decode( + std::string& relayState, + const GenericRequest& genericRequest, + SecurityPolicy& policy + ) const; + }; + + MessageDecoder* SAML_DLLLOCAL SAML2ArtifactDecoderFactory(const pair& p) { - return new SAML2ArtifactDecoder(e); + return new SAML2ArtifactDecoder(); } }; }; -SAML2ArtifactDecoder::SAML2ArtifactDecoder(const DOMElement* e) {} - -SAML2ArtifactDecoder::~SAML2ArtifactDecoder() {} - XMLObject* SAML2ArtifactDecoder::decode( string& relayState, - const RoleDescriptor*& issuer, - const XMLCh*& securityMech, - const HTTPRequest& httpRequest, - const MetadataProvider* metadataProvider, - const QName* role, - const opensaml::TrustEngine* trustEngine + const GenericRequest& genericRequest, + SecurityPolicy& policy ) const { #ifdef _DEBUG @@ -72,25 +81,28 @@ XMLObject* SAML2ArtifactDecoder::decode( Category& log = Category::getInstance(SAML_LOGCAT".MessageDecoder.SAML2Artifact"); log.debug("validating input"); - const char* SAMLart = httpRequest.getParameter("SAMLart"); + const HTTPRequest* httpRequest=dynamic_cast(&genericRequest); + if (!httpRequest) + throw BindingException("Unable to cast request object to HTTPRequest type."); + const char* SAMLart = httpRequest->getParameter("SAMLart"); if (!SAMLart) - return NULL; - const char* state = httpRequest.getParameter("RelayState"); + throw BindingException("Request missing SAMLart query string or form parameter."); + const char* state = httpRequest->getParameter("RelayState"); if (state) relayState = state; - if (!m_artifactResolver || !metadataProvider) + if (!m_artifactResolver || !policy.getMetadataProvider() || !policy.getRole()) throw BindingException("Artifact binding requires ArtifactResolver and MetadataProvider implementations be supplied."); // Import the artifact. - SAMLArtifact* artifact=NULL; - ReplayCache* replayCache = XMLToolingConfig::getConfig().getReplayCache(); + SAMLArtifact* artifact=nullptr; try { log.debug("processing encoded artifact (%s)", SAMLart); - + // Check replay. + ReplayCache* replayCache = XMLToolingConfig::getConfig().getReplayCache(); if (replayCache) { - if (!replayCache->check("SAML2Artifact", SAMLart, time(NULL) + (2*XMLToolingConfig::getConfig().clock_skew_secs))) { + if (!replayCache->check("SAML2Artifact", SAMLart, time(nullptr) + (2*XMLToolingConfig::getConfig().clock_skew_secs))) { log.error("replay detected of artifact (%s)", SAMLart); throw BindingException("Rejecting replayed artifact ($1).", params(1,SAMLart)); } @@ -104,129 +116,62 @@ XMLObject* SAML2ArtifactDecoder::decode( log.error("error parsing artifact (%s)", SAMLart); throw; } - + // Check the type. auto_ptr artifact2(dynamic_cast(artifact)); if (!artifact2.get()) { - throw BindingException("Artifact binding requires SAML 2.0 artifact."); delete artifact; + log.error("wrong artifact type"); + throw BindingException("Artifact binding requires SAML 2.0 artifact."); } - - issuer = NULL; - securityMech = NULL; + log.debug("attempting to determine source of artifact..."); - const EntityDescriptor* provider=metadataProvider->getEntityDescriptor(artifact); - if (!provider) { + MetadataProvider::Criteria& mc = policy.getMetadataProviderCriteria(); + mc.artifact = artifact; + mc.role = policy.getRole(); + mc.protocol = samlconstants::SAML20P_NS; + pair provider=policy.getMetadataProvider()->getEntityDescriptor(mc); + if (!provider.first) { log.error( "metadata lookup failed, unable to determine issuer of artifact (0x%s)", SAMLArtifact::toHex(artifact->getBytes()).c_str() ); throw BindingException("Metadata lookup failed, unable to determine artifact issuer."); } - + if (log.isDebugEnabled()) { - auto_ptr_char issuer(provider->getEntityID()); + auto_ptr_char issuer(provider.first->getEntityID()); log.debug("lookup succeeded, artifact issued by (%s)", issuer.get()); } - - log.debug("attempting to find artifact issuing role..."); - issuer=provider->getRoleDescriptor(*role, samlconstants::SAML20P_NS); - if (!issuer || !dynamic_cast(issuer)) { - log.error("unable to find compatible SAML role (%s) in metadata", role->toString().c_str()); - BindingException ex("Unable to find compatible metadata role for artifact issuer."); - annotateException(&ex,provider); // throws it - } - - try { - auto_ptr response( - m_artifactResolver->resolve( - securityMech, - *(artifact2.get()), - dynamic_cast(*issuer), - dynamic_cast(trustEngine) - ) - ); - - // Check Issuer of outer message. - if (!issuerMatches(response->getIssuer(), provider->getEntityID())) { - log.error("issuer of ArtifactResponse did not match source of artifact"); - throw BindingException("Issuer of ArtifactResponse did not match source of artifact."); - } - - // Extract payload and check that Issuer. - XMLObject* payload = response->getPayload(); - RequestAbstractType* req = NULL; - StatusResponseType* res = dynamic_cast(payload); - if (!res) - req = dynamic_cast(payload); - if (!res && !req) - throw BindingException("ArtifactResponse payload was not a recognized SAML 2.0 protocol message."); - - if (!issuerMatches(res ? res->getIssuer() : req->getIssuer(), provider->getEntityID())) { - log.error("issuer of ArtifactResponse payload did not match source of artifact"); - throw BindingException("Issuer of ArtifactResponse payload did not match source of artifact."); - } - - // Check payload freshness. - time_t now = time(NULL); - if ((res ? res->getIssueInstant() : req->getIssueInstant())->getEpoch() < now-(2*XMLToolingConfig::getConfig().clock_skew_secs)) - throw BindingException("Detected expired ArtifactResponse payload."); - // Check replay. - if (replayCache) { - auto_ptr_char mid(res ? res->getID() : req->getID()); - if (!replayCache->check("SAML2ArtifactPayload", mid.get(), now + (2*XMLToolingConfig::getConfig().clock_skew_secs))) { - log.error("replay detected of ArtifactResponse payload message ID (%s)", mid.get()); - throw BindingException("Rejecting replayed ArtifactResponse payload ($1).", params(1,mid.get())); - } - } - - // Check signatures. - if (trustEngine) { - if (response->getSignature()) { - if (!trustEngine->validate(*(response->getSignature()), *issuer, metadataProvider->getKeyResolver())) { - log.error("unable to verify signature on ArtifactResponse message with supplied trust engine"); - throw BindingException("Message signature failed verification."); - } - else if (!securityMech) { - securityMech = samlconstants::SAML20P_NS; - } - } - Signature* sig = (res ? res->getSignature() : req->getSignature()); - if (sig) { - if (!trustEngine->validate(*sig, *issuer, metadataProvider->getKeyResolver())) { - log.error("unable to verify signature on ArtifactResponse payload with supplied trust engine"); - throw BindingException("Message signature failed verification."); - } - else if (!securityMech) { - securityMech = samlconstants::SAML20P_NS; - } - } - } - - if (!securityMech) { - log.warn("unable to authenticate ArtifactResponse message or payload, leaving untrusted"); - } - - // Return the payload only. - response.release(); - payload->detach(); - return payload; + if (!provider.second || !dynamic_cast(provider.second)) { + log.error("unable to find compatible SAML 2.0 role (%s) in metadata", policy.getRole()->toString().c_str()); + throw BindingException("Unable to find compatible metadata role for artifact issuer."); } - catch (XMLToolingException& ex) { - annotateException(&ex,issuer,false); - throw; + // Set issuer into policy. + policy.setIssuer(provider.first->getEntityID()); + policy.setIssuerMetadata(provider.second); + + log.debug("calling ArtifactResolver..."); + auto_ptr response( + m_artifactResolver->resolve(*(artifact2.get()), dynamic_cast(*provider.second), policy) + ); + + // The policy should be enforced against the ArtifactResponse by the resolve step. + // Reset only the message state. + policy.reset(true); + + // Now extract details from the payload and check that message. + XMLObject* payload = response->getPayload(); + if (!payload) { + log.error("ArtifactResponse message did not contain a protocol message"); + throw BindingException("ArtifactResponse message did not contain a protocol message."); } -} + extractMessageDetails(*payload, genericRequest, samlconstants::SAML20P_NS, policy); + policy.evaluate(*payload, &genericRequest); -bool SAML2ArtifactDecoder::issuerMatches(const Issuer* messageIssuer, const XMLCh* expectedIssuer) const -{ - if (messageIssuer && messageIssuer->getName()) { - if (messageIssuer->getFormat() && !XMLString::equals(messageIssuer->getFormat(), NameIDType::ENTITY)) - return false; - else if (!XMLString::equals(expectedIssuer, messageIssuer->getName())) - return false; - } - return true; + // Return the payload only. + response.release(); + payload->detach(); + return payload; } -