X-Git-Url: http://www.project-moonshot.org/gitweb/?a=blobdiff_plain;f=saml%2Fsaml2%2Fbinding%2Fimpl%2FSAML2POSTDecoder.cpp;h=64404ceafdf4c70ac20c317d1021f864dbdf4e1c;hb=40fdf576ed07e3cf8f88d9bf0441e55ea4fc3d05;hp=a7f1cdab9571178f0392cb398ea6d5da7d0abb06;hpb=1bc8e721db3a50294df852662e1eddcdbdae8f9f;p=shibboleth%2Fcpp-opensaml.git diff --git a/saml/saml2/binding/impl/SAML2POSTDecoder.cpp b/saml/saml2/binding/impl/SAML2POSTDecoder.cpp index a7f1cda..64404ce 100644 --- a/saml/saml2/binding/impl/SAML2POSTDecoder.cpp +++ b/saml/saml2/binding/impl/SAML2POSTDecoder.cpp @@ -1,5 +1,5 @@ /* - * Copyright 2001-2006 Internet2 + * Copyright 2001-2010 Internet2 * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -17,44 +17,72 @@ /** * SAML2POSTDecoder.cpp * - * SAML 2.0 HTTP POST binding message encoder + * SAML 2.0 HTTP POST binding message encoder. */ #include "internal.h" #include "exceptions.h" -#include "binding/HTTPRequest.h" -#include "saml2/binding/SAML2POSTDecoder.h" +#include "binding/SecurityPolicy.h" +#include "saml2/binding/SAML2MessageDecoder.h" #include "saml2/core/Protocols.h" #include "saml2/metadata/Metadata.h" #include "saml2/metadata/MetadataProvider.h" -#include +#include +#include #include +#include +#include +#include #include +#include #include using namespace opensaml::saml2md; using namespace opensaml::saml2p; using namespace opensaml::saml2; using namespace opensaml; +using namespace xmltooling::logging; using namespace xmltooling; -using namespace log4cpp; using namespace std; namespace opensaml { namespace saml2p { - MessageDecoder* SAML_DLLLOCAL SAML2POSTDecoderFactory(const DOMElement* const & e) + class SAML_DLLLOCAL SAML2POSTDecoder : public SAML2MessageDecoder { - return new SAML2POSTDecoder(e); + public: + SAML2POSTDecoder(const DOMElement* e, const XMLCh* ns, bool simple=false) { + } + + virtual ~SAML2POSTDecoder() {} + + const char* getShortName() const { + return m_simple ? "POST-SimpleSign" : "POST"; + } + + xmltooling::XMLObject* decode( + std::string& relayState, + const GenericRequest& genericRequest, + SecurityPolicy& policy + ) const; + + private: + bool m_simple; + }; + + MessageDecoder* SAML_DLLLOCAL SAML2POSTDecoderFactory(const pair& p) + { + return new SAML2POSTDecoder(p.first, p.second, false); + } + + MessageDecoder* SAML_DLLLOCAL SAML2POSTSimpleSignDecoderFactory(const pair& p) + { + return new SAML2POSTDecoder(p.first, p.second, true); } }; }; -SAML2POSTDecoder::SAML2POSTDecoder(const DOMElement* e) {} - -SAML2POSTDecoder::~SAML2POSTDecoder() {} - -saml2::RootObject* SAML2POSTDecoder::decode( +XMLObject* SAML2POSTDecoder::decode( std::string& relayState, const GenericRequest& genericRequest, SecurityPolicy& policy @@ -67,17 +95,15 @@ saml2::RootObject* SAML2POSTDecoder::decode( log.debug("validating input"); const HTTPRequest* httpRequest=dynamic_cast(&genericRequest); - if (!httpRequest) { - log.error("unable to cast request to HTTPRequest type"); - return NULL; - } + if (!httpRequest) + throw BindingException("Unable to cast request object to HTTPRequest type."); if (strcmp(httpRequest->getMethod(),"POST")) - return NULL; + throw BindingException("Invalid HTTP method ($1).", params(1, httpRequest->getMethod())); const char* msg = httpRequest->getParameter("SAMLResponse"); if (!msg) msg = httpRequest->getParameter("SAMLRequest"); if (!msg) - return NULL; + throw BindingException("Request missing SAMLRequest or SAMLResponse form parameter."); const char* state = httpRequest->getParameter("RelayState"); if (state) relayState = state; @@ -85,23 +111,23 @@ saml2::RootObject* SAML2POSTDecoder::decode( relayState.erase(); // Decode the base64 into SAML. - unsigned int x; + xsecsize_t x; XMLByte* decoded=Base64::decode(reinterpret_cast(msg),&x); if (!decoded) throw BindingException("Unable to decode base64 in POST binding message."); - log.debug("decoded SAML message:\n%s", decoded); - istringstream is(reinterpret_cast(decoded)); - XMLString::release(&decoded); + log.debugStream() << "decoded SAML message:\n" << decoded << logging::eol; // Parse and bind the document into an XMLObject. - DOMDocument* doc = (m_validate ? XMLToolingConfig::getConfig().getValidatingParser() - : XMLToolingConfig::getConfig().getParser()).parse(is); + MemBufInputSource src(decoded, x, "SAMLMessage", true); + Wrapper4InputSource dsrc(&src, false); + DOMDocument* doc = (policy.getValidating() ? XMLToolingConfig::getConfig().getValidatingParser() + : XMLToolingConfig::getConfig().getParser()).parse(dsrc); XercesJanitor janitor(doc); auto_ptr xmlObject(XMLObjectBuilder::buildOneFromElement(doc->getDocumentElement(), true)); janitor.release(); - saml2::RootObject* root = NULL; - StatusResponseType* response = NULL; + saml2::RootObject* root = nullptr; + StatusResponseType* response = nullptr; RequestAbstractType* request = dynamic_cast(xmlObject.get()); if (!request) { response = dynamic_cast(xmlObject.get()); @@ -113,60 +139,24 @@ saml2::RootObject* SAML2POSTDecoder::decode( root = static_cast(request); } - try { - if (!m_validate) - SchemaValidators.validate(xmlObject.get()); - - // Check destination URL. - auto_ptr_char dest(request ? request->getDestination() : response->getDestination()); - const char* dest2 = httpRequest->getRequestURL(); - if (root->getSignature() && !dest.get() || !*(dest.get())) { - log.error("signed SAML message missing Destination attribute"); - throw BindingException("Signed SAML message missing Destination attribute identifying intended destination."); - } - else if (dest.get() && (!dest2 || !*dest2 || strcmp(dest.get(),dest2))) { - log.error("POST targeted at (%s), but delivered to (%s)", dest.get(), dest2 ? dest2 : "none"); - throw BindingException("SAML message delivered with POST to incorrect server URL."); - } - - // Run through the policy. - policy.evaluate(genericRequest, *response); - } - catch (XMLToolingException& ex) { - // This is just to maximize the likelihood of attaching a source to the message for support purposes. - if (policy.getIssuerMetadata()) - annotateException(&ex,policy.getIssuerMetadata()); // throws it - - const Issuer* claimedIssuer = root->getIssuer(); - if (!claimedIssuer) { - // Check for assertions. - const Response* assbag = dynamic_cast(response); - if (assbag) { - const vector& assertions=assbag->getAssertions(); - if (!assertions.empty()) - claimedIssuer = assertions.front()->getIssuer(); - } - } - - if (!claimedIssuer || !claimedIssuer->getName()) - throw; - const EntityDescriptor* provider=NULL; - if (!policy.getMetadataProvider() || - !(provider=policy.getMetadataProvider()->getEntityDescriptor(claimedIssuer->getName(), false))) { - // Just record it. - auto_ptr_char iname(claimedIssuer->getName()); - if (iname.get()) - ex.addProperty("entityID", iname.get()); - throw; - } + SchemaValidators.validate(root); - if (policy.getRole()) { - const RoleDescriptor* roledesc=provider->getRoleDescriptor(*(policy.getRole()), samlconstants::SAML20P_NS); - if (roledesc) annotateException(&ex,roledesc); // throws it - } - annotateException(&ex,provider); // throws it + // Run through the policy. + extractMessageDetails(*root, genericRequest, samlconstants::SAML20P_NS, policy); + policy.evaluate(*root, &genericRequest); + + // Check destination URL. + auto_ptr_char dest(request ? request->getDestination() : response->getDestination()); + const char* dest2 = httpRequest->getRequestURL(); + const char* delim = strchr(dest2, '?'); + if ((root->getSignature() || httpRequest->getParameter("Signature")) && (!dest.get() || !*(dest.get()))) { + log.error("signed SAML message missing Destination attribute"); + throw BindingException("Signed SAML message missing Destination attribute identifying intended destination."); } - - xmlObject.release(); - return root; + else if (dest.get() && *dest.get() && ((delim && strncmp(dest.get(), dest2, delim - dest2)) || (!delim && strcmp(dest.get(),dest2)))) { + log.error("POST targeted at (%s), but delivered to (%s)", dest.get(), dest2); + throw BindingException("SAML message delivered with POST to incorrect server URL."); + } + + return xmlObject.release(); }