X-Git-Url: http://www.project-moonshot.org/gitweb/?a=blobdiff_plain;f=saml%2Fsaml2%2Fbinding%2Fimpl%2FSAML2POSTDecoder.cpp;h=87c5da1f24eca2e27cb7987b8a56568542ccecef;hb=c072b75e6f6e05e24a1c35b952008b38d0d375c1;hp=5f659a560f0ce4ef9f304a7fc119241aa1a1bf96;hpb=0703fa970c8d1f15600ce3fd1b350bdb90930bb9;p=shibboleth%2Fcpp-opensaml.git diff --git a/saml/saml2/binding/impl/SAML2POSTDecoder.cpp b/saml/saml2/binding/impl/SAML2POSTDecoder.cpp index 5f659a5..87c5da1 100644 --- a/saml/saml2/binding/impl/SAML2POSTDecoder.cpp +++ b/saml/saml2/binding/impl/SAML2POSTDecoder.cpp @@ -1,5 +1,5 @@ /* - * Copyright 2001-2006 Internet2 + * Copyright 2001-2009 Internet2 * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -22,48 +22,55 @@ #include "internal.h" #include "exceptions.h" -#include "saml2/binding/SAML2POSTDecoder.h" +#include "binding/SecurityPolicy.h" +#include "saml2/binding/SAML2MessageDecoder.h" #include "saml2/core/Protocols.h" #include "saml2/metadata/Metadata.h" #include "saml2/metadata/MetadataProvider.h" -#include "security/X509TrustEngine.h" -#include +#include +#include #include +#include +#include +#include #include -#include #include using namespace opensaml::saml2md; using namespace opensaml::saml2p; using namespace opensaml::saml2; using namespace opensaml; -using namespace xmlsignature; +using namespace xmltooling::logging; using namespace xmltooling; -using namespace log4cpp; using namespace std; namespace opensaml { namespace saml2p { - MessageDecoder* SAML_DLLLOCAL SAML2POSTDecoderFactory(const DOMElement* const & e) + class SAML_DLLLOCAL SAML2POSTDecoder : public SAML2MessageDecoder { - return new SAML2POSTDecoder(e); + public: + SAML2POSTDecoder() {} + virtual ~SAML2POSTDecoder() {} + + xmltooling::XMLObject* decode( + std::string& relayState, + const GenericRequest& genericRequest, + SecurityPolicy& policy + ) const; + }; + + MessageDecoder* SAML_DLLLOCAL SAML2POSTDecoderFactory(const pair& p) + { + return new SAML2POSTDecoder(); } }; }; -SAML2POSTDecoder::SAML2POSTDecoder(const DOMElement* e) {} - -SAML2POSTDecoder::~SAML2POSTDecoder() {} - XMLObject* SAML2POSTDecoder::decode( - string& relayState, - const RoleDescriptor*& issuer, - bool& issuerTrusted, - const HTTPRequest& httpRequest, - const MetadataProvider* metadataProvider, - const QName* role, - const opensaml::TrustEngine* trustEngine + std::string& relayState, + const GenericRequest& genericRequest, + SecurityPolicy& policy ) const { #ifdef _DEBUG @@ -72,157 +79,69 @@ XMLObject* SAML2POSTDecoder::decode( Category& log = Category::getInstance(SAML_LOGCAT".MessageDecoder.SAML2POST"); log.debug("validating input"); - if (strcmp(httpRequest.getMethod(),"POST")) - return NULL; - const char* msg = httpRequest.getParameter("SAMLResponse"); + const HTTPRequest* httpRequest=dynamic_cast(&genericRequest); + if (!httpRequest) + throw BindingException("Unable to cast request object to HTTPRequest type."); + if (strcmp(httpRequest->getMethod(),"POST")) + throw BindingException("Invalid HTTP method ($1).", params(1, httpRequest->getMethod())); + const char* msg = httpRequest->getParameter("SAMLResponse"); if (!msg) - msg = httpRequest.getParameter("SAMLRequest"); + msg = httpRequest->getParameter("SAMLRequest"); if (!msg) - return NULL; - const char* state = httpRequest.getParameter("RelayState"); + throw BindingException("Request missing SAMLRequest or SAMLResponse form parameter."); + const char* state = httpRequest->getParameter("RelayState"); if (state) relayState = state; else relayState.erase(); // Decode the base64 into SAML. - unsigned int x; + xsecsize_t x; XMLByte* decoded=Base64::decode(reinterpret_cast(msg),&x); if (!decoded) throw BindingException("Unable to decode base64 in POST binding message."); - log.debug("decoded SAML message:\n%s", decoded); - istringstream is(reinterpret_cast(decoded)); - XMLString::release(&decoded); + log.debugStream() << "decoded SAML message:\n" << decoded << logging::eol; // Parse and bind the document into an XMLObject. - DOMDocument* doc = (m_validate ? XMLToolingConfig::getConfig().getValidatingParser() - : XMLToolingConfig::getConfig().getParser()).parse(is); + MemBufInputSource src(decoded, x, "SAMLMessage", true); + Wrapper4InputSource dsrc(&src, false); + DOMDocument* doc = (policy.getValidating() ? XMLToolingConfig::getConfig().getValidatingParser() + : XMLToolingConfig::getConfig().getParser()).parse(dsrc); XercesJanitor janitor(doc); auto_ptr xmlObject(XMLObjectBuilder::buildOneFromElement(doc->getDocumentElement(), true)); janitor.release(); + saml2::RootObject* root = NULL; StatusResponseType* response = NULL; RequestAbstractType* request = dynamic_cast(xmlObject.get()); if (!request) { response = dynamic_cast(xmlObject.get()); if (!response) throw BindingException("XML content for SAML 2.0 HTTP-POST Decoder must be a SAML 2.0 protocol message."); + root = static_cast(response); } - - /* For SAML 2, the issuer can be established either from the message, or in some profiles - * it's possible to omit it and defer to assertions in a Response. - * The Issuer is later matched against metadata, and then trust checking can be applied. - */ - const Issuer* claimedIssuer = request ? request->getIssuer() : response->getIssuer(); - if (!claimedIssuer) { - // Check assertion option. I cannot resist the variable name, for the sake of google. - const Response* assbag = dynamic_cast(response); - if (assbag) { - const vector& assertions=assbag->getAssertions(); - if (!assertions.empty()) - claimedIssuer = assertions.front()->getIssuer(); - } + else { + root = static_cast(request); } + + SchemaValidators.validate(root); - const EntityDescriptor* provider=NULL; - try { - if (!m_validate) - SchemaValidators.validate(xmlObject.get()); - - Signature* signature = request ? request->getSignature() : response->getSignature(); - - // Check destination URL. - auto_ptr_char dest(request ? request->getDestination() : response->getDestination()); - const char* dest2 = httpRequest.getRequestURL(); - if (signature && !dest.get() || !*(dest.get())) { - log.error("signed SAML message missing Destination attribute"); - throw BindingException("Signed SAML message missing Destination attribute identifying intended destination."); - } - else if (dest.get() && (!dest2 || !*dest2 || strcmp(dest.get(),dest2))) { - log.error("POST targeted at (%s), but delivered to (%s)", dest.get(), dest2 ? dest2 : "none"); - throw BindingException("SAML message delivered with POST to incorrect server URL."); - } - - // Check freshness. - time_t now = time(NULL); - if ((request ? request->getIssueInstant()->getEpoch() : response->getIssueInstant()->getEpoch()) - < now-(2*XMLToolingConfig::getConfig().clock_skew_secs)) - throw BindingException("Detected expired POST binding message."); - - // Check replay. - ReplayCache* replayCache = XMLToolingConfig::getConfig().getReplayCache(); - if (replayCache) { - auto_ptr_char id(xmlObject->getXMLID()); - if (!replayCache->check("SAML2POST", id.get(), response->getIssueInstant()->getEpoch() + (2*XMLToolingConfig::getConfig().clock_skew_secs))) { - log.error("replay detected of response ID (%s)", id.get()); - throw BindingException("Rejecting replayed response ID ($1).", params(1,id.get())); - } - } - else - log.warn("replay cache was not provided, this is a serious security risk!"); - - issuer = NULL; - issuerTrusted = false; - log.debug("attempting to establish issuer and integrity of message..."); - - // If we can't identify the issuer, we're done, since we can't lookup or verify anything. - if (!claimedIssuer || !claimedIssuer->getName()) { - log.warn("unable to establish identity of message issuer"); - return xmlObject.release(); - } - else if (claimedIssuer->getFormat() && !XMLString::equals(claimedIssuer->getFormat(), NameIDType::ENTITY)) { - auto_ptr_char iformat(claimedIssuer->getFormat()); - log.warn("message issuer was in an unsupported format (%s)", iformat.get()); - return xmlObject.release(); - } - - log.debug("searching metadata for assertion issuer..."); - provider=metadataProvider ? metadataProvider->getEntityDescriptor(claimedIssuer->getName()) : NULL; - if (provider) { - log.debug("matched assertion issuer against metadata, searching for applicable role..."); - issuer=provider->getRoleDescriptor(*role, samlconstants::SAML20P_NS); - if (issuer) { - if (trustEngine && signature) { - issuerTrusted = trustEngine->validate(*signature, *issuer, metadataProvider->getKeyResolver()); - if (!issuerTrusted) { - log.error("unable to verify signature on message with supplied trust engine"); - throw BindingException("Message signature failed verification."); - } - } - else { - log.warn("unable to verify integrity of the message, leaving untrusted"); - } - } - else { - log.warn("unable to find compatible SAML 2.0 role (%s) in metadata", role->toString().c_str()); - } - if (log.isDebugEnabled()) { - auto_ptr_char iname(provider->getEntityID()); - log.debug("message from (%s), integrity %sverified", iname.get(), issuerTrusted ? "" : "NOT "); - } - } - else { - auto_ptr_char temp(claimedIssuer->getName()); - log.warn("no metadata found, can't establish identity of issuer (%s)", temp.get()); - } + // Run through the policy. + extractMessageDetails(*root, genericRequest, samlconstants::SAML20P_NS, policy); + policy.evaluate(*root, &genericRequest); + + // Check destination URL. + auto_ptr_char dest(request ? request->getDestination() : response->getDestination()); + const char* dest2 = httpRequest->getRequestURL(); + const char* delim = strchr(dest2, '?'); + if ((root->getSignature() || httpRequest->getParameter("Signature")) && (!dest.get() || !*(dest.get()))) { + log.error("signed SAML message missing Destination attribute"); + throw BindingException("Signed SAML message missing Destination attribute identifying intended destination."); } - catch (XMLToolingException& ex) { - if (!provider) { - if (!claimedIssuer || !claimedIssuer->getName()) - throw; - if (!metadataProvider || !(provider=metadataProvider->getEntityDescriptor(claimedIssuer->getName(), false))) { - // Just record it. - auto_ptr_char iname(claimedIssuer->getName()); - if (iname.get()) - ex.addProperty("entityID", iname.get()); - throw; - } - } - if (!issuer) - issuer=provider->getRoleDescriptor(*role, samlconstants::SAML20P_NS); - if (issuer) annotateException(&ex,issuer); // throws it - annotateException(&ex,provider); // throws it + else if (dest.get() && *dest.get() && ((delim && strncmp(dest.get(), dest2, delim - dest2)) || (!delim && strcmp(dest.get(),dest2)))) { + log.error("POST targeted at (%s), but delivered to (%s)", dest.get(), dest2); + throw BindingException("SAML message delivered with POST to incorrect server URL."); } - + return xmlObject.release(); }