X-Git-Url: http://www.project-moonshot.org/gitweb/?a=blobdiff_plain;f=shibsp%2Fimpl%2FXMLServiceProvider.cpp;h=5c6c4cf8b2c34e61789ee39e35720eaa4b498edd;hb=392d1448deb48beb75f219532ac248b4776f16db;hp=b886e93836ac06333cc67af634750d0cb39ce7a4;hpb=5c402432ecb3f624e8a38b10e7ce6d9958a0c357;p=shibboleth%2Fsp.git diff --git a/shibsp/impl/XMLServiceProvider.cpp b/shibsp/impl/XMLServiceProvider.cpp index b886e93..5c6c4cf 100644 --- a/shibsp/impl/XMLServiceProvider.cpp +++ b/shibsp/impl/XMLServiceProvider.cpp @@ -28,14 +28,18 @@ #include "ServiceProvider.h" #include "SessionCache.h" #include "SPConfig.h" -#include "SPRequest.h" #include "handler/SessionInitiator.h" #include "remoting/ListenerService.h" #include "util/DOMPropertySet.h" #include "util/SPConstants.h" -#include -#include +#if defined(XMLTOOLING_LOG4SHIB) +# include +#elif defined(XMLTOOLING_LOG4CPP) +# include +#else +# error "Supported logging library not available." +#endif #include #include #include @@ -64,7 +68,6 @@ using namespace opensaml; using namespace shibsp; using namespace xmltooling; -using namespace log4cpp; using namespace std; namespace { @@ -83,9 +86,6 @@ namespace { XMLApplication(const ServiceProvider*, const DOMElement* e, const XMLApplication* base=NULL); ~XMLApplication() { cleanup(); } - // Application - const ServiceProvider& getServiceProvider() const {return *m_sp;} - const char* getId() const {return getString("id").second;} const char* getHash() const {return m_hash.c_str();} #ifndef SHIBSP_LITE @@ -95,11 +95,10 @@ namespace { SAML2Artifact* generateSAML2Artifact(const EntityDescriptor* relyingParty) const { pair index = make_pair(false,0); const PropertySet* props = getRelyingParty(relyingParty); - if (props) - index = getInt("artifactEndpointIndex"); + index = props->getInt("artifactEndpointIndex"); if (!index.first) index = getArtifactEndpointIndex(); - return new SAML2ArtifactType0004(SAMLConfig::getConfig().hashSHA1(getString("entityID").second),index.first ? index.second : 1); + return new SAML2ArtifactType0004(SAMLConfig::getConfig().hashSHA1(props->getString("entityID").second),index.first ? index.second : 1); } MetadataProvider* getMetadataProvider(bool required=true) const { @@ -125,29 +124,31 @@ namespace { return (!m_credResolver && m_base) ? m_base->getCredentialResolver() : m_credResolver; } const PropertySet* getRelyingParty(const EntityDescriptor* provider) const; - const vector& getAudiences() const { - return (m_audiences.empty() && m_base) ? m_base->getAudiences() : m_audiences; + const vector* getAudiences() const { + return (m_audiences.empty() && m_base) ? m_base->getAudiences() : &m_audiences; } #endif - const set& getRemoteUserAttributeIds() const { + string getNotificationURL(const char* resource, bool front, unsigned int index) const; + + const vector& getRemoteUserAttributeIds() const { return (m_remoteUsers.empty() && m_base) ? m_base->getRemoteUserAttributeIds() : m_remoteUsers; } - void clearAttributeHeaders(SPRequest& request) const; const SessionInitiator* getDefaultSessionInitiator() const; const SessionInitiator* getSessionInitiatorById(const char* id) const; const Handler* getDefaultAssertionConsumerService() const; const Handler* getAssertionConsumerServiceByIndex(unsigned short index) const; const vector& getAssertionConsumerServicesByBinding(const XMLCh* binding) const; const Handler* getHandler(const char* path) const; + void getHandlers(vector& handlers) const; void receive(DDF& in, ostream& out) { // Only current function is to return the headers to clear. DDF header; DDF ret=DDF(NULL).list(); DDFJanitor jret(ret); - for (vector::const_iterator i = m_unsetHeaders.begin(); i!=m_unsetHeaders.end(); ++i) { - header = DDF(NULL).string(i->c_str()); + for (vector< pair >::const_iterator i = m_unsetHeaders.begin(); i!=m_unsetHeaders.end(); ++i) { + header = DDF(i->first.c_str()).string(i->second.c_str()); ret.add(header); } out << ret; @@ -158,7 +159,6 @@ namespace { private: void cleanup(); - const ServiceProvider* m_sp; // this is ok because its locking scope includes us const XMLApplication* m_base; string m_hash; #ifndef SHIBSP_LITE @@ -171,16 +171,13 @@ namespace { vector m_audiences; // RelyingParty properties - DOMPropertySet* m_partyDefault; #ifdef HAVE_GOOD_STL map m_partyMap; #else map m_partyMap; #endif #endif - set m_remoteUsers; - mutable vector m_unsetHeaders; - RWLock* m_unsetLock; + vector m_remoteUsers,m_frontLogout,m_backLogout; // manage handler objects vector m_handlers; @@ -229,6 +226,7 @@ namespace { map m_appmap; #ifndef SHIBSP_LITE map< string,pair< PropertySet*,vector > > m_policyMap; + map< string, vector< pair< string, pair > > > m_transportOptionMap; #endif // Provides filter to exclude special config elements. @@ -240,12 +238,16 @@ namespace { private: void doExtensions(const DOMElement* e, const char* label, Category& log); + void cleanup(); const XMLConfig* m_outer; DOMDocument* m_document; }; - class SHIBSP_DLLLOCAL XMLConfig : public ServiceProvider, public ReloadableXMLFile, public Remoted + class SHIBSP_DLLLOCAL XMLConfig : public ServiceProvider, public ReloadableXMLFile +#ifndef SHIBSP_LITE + ,public Remoted +#endif { public: XMLConfig(const DOMElement* e) : ReloadableXMLFile(e, Category::getInstance(SHIBSP_LOGCAT".Config")), @@ -273,20 +275,22 @@ namespace { } // PropertySet + const PropertySet* getParent() const { return m_impl->getParent(); } void setParent(const PropertySet* parent) {return m_impl->setParent(parent);} pair getBool(const char* name, const char* ns=NULL) const {return m_impl->getBool(name,ns);} pair getString(const char* name, const char* ns=NULL) const {return m_impl->getString(name,ns);} pair getXMLString(const char* name, const char* ns=NULL) const {return m_impl->getXMLString(name,ns);} pair getUnsignedInt(const char* name, const char* ns=NULL) const {return m_impl->getUnsignedInt(name,ns);} pair getInt(const char* name, const char* ns=NULL) const {return m_impl->getInt(name,ns);} + void getAll(map& properties) const {return m_impl->getAll(properties);} const PropertySet* getPropertySet(const char* name, const char* ns="urn:mace:shibboleth:2.0:native:sp:config") const {return m_impl->getPropertySet(name,ns);} const DOMElement* getElement() const {return m_impl->getElement();} + // ServiceProvider +#ifndef SHIBSP_LITE // Remoted void receive(DDF& in, ostream& out); - // ServiceProvider -#ifndef SHIBSP_LITE TransactionLog* getTransactionLog() const { if (m_tranLog) return m_tranLog; @@ -340,6 +344,22 @@ namespace { return i->second.second; throw ConfigurationException("Security Policy ($1) not found, check element.", params(1,id)); } + + bool setTransportOptions(const char* id, SOAPTransport& transport) const { + bool ret = true; + map< string, vector< pair< string, pair > > >::const_iterator p = + m_impl->m_transportOptionMap.find(id); + if (p == m_impl->m_transportOptionMap.end()) + return ret; + vector< pair< string, pair > >::const_iterator opt; + for (opt = p->second.begin(); opt != p->second.end(); ++opt) { + if (!transport.setProviderOption(opt->first.c_str(), opt->second.first.c_str(), opt->second.second.c_str())) { + m_log.error("failed to set SOAPTransport option (%s)", opt->second.first.c_str()); + ret = false; + } + } + return ret; + } #endif protected: @@ -370,23 +390,26 @@ namespace { static const XMLCh _ArtifactResolutionService[] =UNICODE_LITERAL_25(A,r,t,i,f,a,c,t,R,e,s,o,l,u,t,i,o,n,S,e,r,v,i,c,e); static const XMLCh _Audience[] = UNICODE_LITERAL_8(A,u,d,i,e,n,c,e); static const XMLCh Binding[] = UNICODE_LITERAL_7(B,i,n,d,i,n,g); + static const XMLCh Channel[]= UNICODE_LITERAL_7(C,h,a,n,n,e,l); static const XMLCh _CredentialResolver[] = UNICODE_LITERAL_18(C,r,e,d,e,n,t,i,a,l,R,e,s,o,l,v,e,r); - static const XMLCh DefaultRelyingParty[] = UNICODE_LITERAL_19(D,e,f,a,u,l,t,R,e,l,y,i,n,g,P,a,r,t,y); static const XMLCh _Extensions[] = UNICODE_LITERAL_10(E,x,t,e,n,s,i,o,n,s); - static const XMLCh fatal[] = UNICODE_LITERAL_5(f,a,t,a,l); + static const XMLCh _fatal[] = UNICODE_LITERAL_5(f,a,t,a,l); static const XMLCh _Handler[] = UNICODE_LITERAL_7(H,a,n,d,l,e,r); static const XMLCh _id[] = UNICODE_LITERAL_2(i,d); - static const XMLCh Implementation[] = UNICODE_LITERAL_14(I,m,p,l,e,m,e,n,t,a,t,i,o,n); static const XMLCh InProcess[] = UNICODE_LITERAL_9(I,n,P,r,o,c,e,s,s); static const XMLCh Library[] = UNICODE_LITERAL_7(L,i,b,r,a,r,y); static const XMLCh Listener[] = UNICODE_LITERAL_8(L,i,s,t,e,n,e,r); + static const XMLCh Location[] = UNICODE_LITERAL_8(L,o,c,a,t,i,o,n); static const XMLCh logger[] = UNICODE_LITERAL_6(l,o,g,g,e,r); + static const XMLCh _LogoutInitiator[] = UNICODE_LITERAL_15(L,o,g,o,u,t,I,n,i,t,i,a,t,o,r); static const XMLCh _ManageNameIDService[] = UNICODE_LITERAL_19(M,a,n,a,g,e,N,a,m,e,I,D,S,e,r,v,i,c,e); - static const XMLCh MemoryListener[] = UNICODE_LITERAL_14(M,e,m,o,r,y,L,i,s,t,e,n,e,r); static const XMLCh _MetadataProvider[] = UNICODE_LITERAL_16(M,e,t,a,d,a,t,a,P,r,o,v,i,d,e,r); + static const XMLCh Notify[] = UNICODE_LITERAL_6(N,o,t,i,f,y); + static const XMLCh _option[] = UNICODE_LITERAL_6(o,p,t,i,o,n); static const XMLCh OutOfProcess[] = UNICODE_LITERAL_12(O,u,t,O,f,P,r,o,c,e,s,s); static const XMLCh _path[] = UNICODE_LITERAL_4(p,a,t,h); static const XMLCh Policy[] = UNICODE_LITERAL_6(P,o,l,i,c,y); + static const XMLCh _provider[] = UNICODE_LITERAL_8(p,r,o,v,i,d,e,r); static const XMLCh RelyingParty[] = UNICODE_LITERAL_12(R,e,l,y,i,n,g,P,a,r,t,y); static const XMLCh _ReplayCache[] = UNICODE_LITERAL_11(R,e,p,l,a,y,C,a,c,h,e); static const XMLCh _RequestMapper[] = UNICODE_LITERAL_13(R,e,q,u,e,s,t,M,a,p,p,e,r); @@ -395,21 +418,23 @@ namespace { static const XMLCh _SessionCache[] = UNICODE_LITERAL_12(S,e,s,s,i,o,n,C,a,c,h,e); static const XMLCh _SessionInitiator[] = UNICODE_LITERAL_16(S,e,s,s,i,o,n,I,n,i,t,i,a,t,o,r); static const XMLCh _SingleLogoutService[] = UNICODE_LITERAL_19(S,i,n,g,l,e,L,o,g,o,u,t,S,e,r,v,i,c,e); + static const XMLCh Site[] = UNICODE_LITERAL_4(S,i,t,e); static const XMLCh _StorageService[] = UNICODE_LITERAL_14(S,t,o,r,a,g,e,S,e,r,v,i,c,e); static const XMLCh TCPListener[] = UNICODE_LITERAL_11(T,C,P,L,i,s,t,e,n,e,r); + static const XMLCh TransportOption[] = UNICODE_LITERAL_15(T,r,a,n,s,p,o,r,t,O,p,t,i,o,n); static const XMLCh _TrustEngine[] = UNICODE_LITERAL_11(T,r,u,s,t,E,n,g,i,n,e); static const XMLCh _type[] = UNICODE_LITERAL_4(t,y,p,e); static const XMLCh UnixListener[] = UNICODE_LITERAL_12(U,n,i,x,L,i,s,t,e,n,e,r); +#ifndef SHIBSP_LITE class SHIBSP_DLLLOCAL PolicyNodeFilter : public DOMNodeFilter { public: short acceptNode(const DOMNode* node) const { - if (XMLHelper::isNodeNamed(node,shibspconstants::SHIB2SPCONFIG_NS,Rule)) - return FILTER_REJECT; - return FILTER_ACCEPT; + return FILTER_REJECT; } }; +#endif }; namespace shibsp { @@ -423,13 +448,13 @@ XMLApplication::XMLApplication( const ServiceProvider* sp, const DOMElement* e, const XMLApplication* base - ) : m_sp(sp), m_base(base), + ) : Application(sp), m_base(base), #ifndef SHIBSP_LITE m_metadata(NULL), m_trust(NULL), m_attrExtractor(NULL), m_attrFilter(NULL), m_attrResolver(NULL), - m_credResolver(NULL), m_partyDefault(NULL), + m_credResolver(NULL), #endif - m_unsetLock(NULL), m_acsDefault(NULL), m_sessionInitDefault(NULL), m_artifactResolutionDefault(NULL) + m_acsDefault(NULL), m_sessionInitDefault(NULL), m_artifactResolutionDefault(NULL) { #ifdef _DEBUG xmltooling::NDC ndc("XMLApplication"); @@ -445,8 +470,8 @@ XMLApplication::XMLApplication( SPConfig& conf=SPConfig::getConfig(); #ifndef SHIBSP_LITE SAMLConfig& samlConf=SAMLConfig::getConfig(); -#endif XMLToolingConfig& xmlConf=XMLToolingConfig::getConfig(); +#endif // This used to be an actual hash, but now it's just a hex-encode to avoid xmlsec. static char DIGITS[] = {'0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f'}; @@ -472,7 +497,7 @@ XMLApplication::XMLApplication( pos = strchr(start,' '); if (pos) *pos=0; - m_remoteUsers.insert(start); + m_remoteUsers.push_back(start); start = pos ? pos+1 : NULL; } free(dup); @@ -480,6 +505,16 @@ XMLApplication::XMLApplication( attributes = getString("unsetHeaders"); if (attributes.first) { + string transformedprefix("HTTP_"); + const char* pch; + pair prefix = getString("metadataAttributePrefix"); + if (prefix.first) { + pch = prefix.second; + while (*pch) { + transformedprefix += (isalnum(*pch) ? toupper(*pch) : '_'); + pch++; + } + } char* dup = strdup(attributes.second); char* pos; char* start = dup; @@ -491,11 +526,20 @@ XMLApplication::XMLApplication( pos = strchr(start,' '); if (pos) *pos=0; - m_unsetHeaders.push_back(start); + + string transformed; + pch = start; + while (*pch) { + transformed += (isalnum(*pch) ? toupper(*pch) : '_'); + pch++; + } + m_unsetHeaders.push_back(pair(start,string("HTTP_") + transformed)); + if (prefix.first) + m_unsetHeaders.push_back(pair(string(prefix.second) + start, transformedprefix + transformed)); start = pos ? pos+1 : NULL; } free(dup); - m_unsetHeaders.push_back("Shib-Application-ID"); + m_unsetHeaders.push_back(pair("Shib-Application-ID","HTTP_SHIB_APPLICATION_ID")); } } @@ -506,10 +550,22 @@ XMLApplication::XMLApplication( pair location = sessions ? sessions->getString("exportLocation") : pair(false,NULL); if (location.first) { try { - handler = conf.HandlerManager.newPlugin(samlconstants::SAML20_BINDING_URI, make_pair(sessions->getElement(), getId())); + DOMElement* exportElement = e->getOwnerDocument()->createElementNS(shibspconstants::SHIB2SPCONFIG_NS,_Handler); + exportElement->setAttributeNS(NULL,Location,sessions->getXMLString("exportLocation").second); + pair exportACL = sessions->getXMLString("exportACL"); + if (exportACL.first) { + static const XMLCh _acl[] = UNICODE_LITERAL_9(e,x,p,o,r,t,A,C,L); + exportElement->setAttributeNS(NULL,_acl,exportACL.second); + } + handler = conf.HandlerManager.newPlugin( + samlconstants::SAML20_BINDING_URI, pair(exportElement, getId()) + ); m_handlers.push_back(handler); - // Insert into location map. + // Insert into location map. If it contains the handlerURL, we skip past that part. + const char* pch = strstr(location.second, sessions->getString("handlerURL").second); + if (pch) + location.second = pch + strlen(sessions->getString("handlerURL").second); if (*location.second == '/') m_handlerMap[location.second]=handler; else @@ -579,6 +635,15 @@ XMLApplication::XMLApplication( m_sessionInitDefault=sihandler; } } + else if (XMLString::equals(child->getLocalName(),_LogoutInitiator)) { + auto_ptr_char type(child->getAttributeNS(NULL,_type)); + if (!type.get() || !*(type.get())) { + log.warn("LogoutInitiator element has no type attribute, skipping it..."); + child = XMLHelper::getNextSiblingElement(child); + continue; + } + handler=conf.LogoutInitiatorManager.newPlugin(type.get(),make_pair(child, getId())); + } else if (XMLString::equals(child->getLocalName(),_ArtifactResolutionService)) { auto_ptr_char bindprop(child->getAttributeNS(NULL,Binding)); if (!bindprop.get() || !*(bindprop.get())) { @@ -645,15 +710,27 @@ XMLApplication::XMLApplication( child = XMLHelper::getNextSiblingElement(child); } + // Notification. + DOMNodeList* nlist=e->getElementsByTagNameNS(shibspconstants::SHIB2SPCONFIG_NS,Notify); + for (XMLSize_t i=0; nlist && igetLength(); i++) { + if (nlist->item(i)->getParentNode()->isSameNode(e)) { + const XMLCh* channel = static_cast(nlist->item(i))->getAttributeNS(NULL,Channel); + auto_ptr_char loc(static_cast(nlist->item(i))->getAttributeNS(NULL,Location)); + if (loc.get() && *loc.get()) { + if (channel && *channel == chLatin_f) + m_frontLogout.push_back(loc.get()); + else + m_backLogout.push_back(loc.get()); + } + } + } + #ifndef SHIBSP_LITE - DOMNodeList* nlist=e->getElementsByTagNameNS(samlconstants::SAML20_NS,Audience::LOCAL_NAME); + nlist=e->getElementsByTagNameNS(samlconstants::SAML20_NS,Audience::LOCAL_NAME); for (XMLSize_t i=0; nlist && igetLength(); i++) if (nlist->item(i)->getParentNode()->isSameNode(e) && nlist->item(i)->hasChildNodes()) m_audiences.push_back(nlist->item(i)->getFirstChild()->getNodeValue()); - // Always include our own entityID as an audience. - m_audiences.push_back(getXMLString("entityID").second); - if (conf.isEnabled(SPConfig::Metadata)) { child = XMLHelper::getFirstChildElement(e,_MetadataProvider); if (child) { @@ -722,18 +799,45 @@ XMLApplication::XMLApplication( } if (m_unsetHeaders.empty()) { + vector unsetHeaders; if (m_attrExtractor) { Locker extlock(m_attrExtractor); - m_attrExtractor->getAttributeIds(m_unsetHeaders); + m_attrExtractor->getAttributeIds(unsetHeaders); } if (m_attrResolver) { Locker reslock(m_attrResolver); - m_attrResolver->getAttributeIds(m_unsetHeaders); + m_attrResolver->getAttributeIds(unsetHeaders); + } + if (unsetHeaders.empty()) { + if (m_base) + m_unsetHeaders.insert(m_unsetHeaders.end(), m_base->m_unsetHeaders.begin(), m_base->m_unsetHeaders.end()); + else + m_unsetHeaders.push_back(pair("Shib-Application-ID","HTTP_SHIB_APPLICATION_ID")); + } + else { + string transformedprefix("HTTP_"); + const char* pch; + pair prefix = getString("metadataAttributePrefix"); + if (prefix.first) { + pch = prefix.second; + while (*pch) { + transformedprefix += (isalnum(*pch) ? toupper(*pch) : '_'); + pch++; + } + } + for (vector::const_iterator hdr = unsetHeaders.begin(); hdr!=unsetHeaders.end(); ++hdr) { + string transformed; + pch = hdr->c_str(); + while (*pch) { + transformed += (isalnum(*pch) ? toupper(*pch) : '_'); + pch++; + } + m_unsetHeaders.push_back(pair(*hdr, string("HTTP_") + transformed)); + if (prefix.first) + m_unsetHeaders.push_back(pair(string(prefix.second) + *hdr, transformedprefix + transformed)); + } + m_unsetHeaders.push_back(pair("Shib-Application-ID","HTTP_SHIB_APPLICATION_ID")); } - if (m_base && m_unsetHeaders.empty()) - m_unsetHeaders.insert(m_unsetHeaders.end(), m_base->m_unsetHeaders.begin(), m_base->m_unsetHeaders.end()); - else - m_unsetHeaders.push_back("Shib-Application-ID"); } } @@ -752,26 +856,18 @@ XMLApplication::XMLApplication( } // Finally, load relying parties. - child = XMLHelper::getFirstChildElement(e,DefaultRelyingParty); - if (child) { - m_partyDefault=new DOMPropertySet(); - m_partyDefault->load(child,log,this); - child = XMLHelper::getFirstChildElement(child,RelyingParty); - while (child) { - auto_ptr rp(new DOMPropertySet()); - rp->load(child,log,this); - rp->setParent(m_partyDefault); - m_partyMap[child->getAttributeNS(NULL,saml2::Attribute::NAME_ATTRIB_NAME)]=rp.release(); - child = XMLHelper::getNextSiblingElement(child,RelyingParty); - } + child = XMLHelper::getFirstChildElement(e,RelyingParty); + while (child) { + auto_ptr rp(new DOMPropertySet()); + rp->load(child,log,this); + rp->setParent(this); + m_partyMap[child->getAttributeNS(NULL,saml2::Attribute::NAME_ATTRIB_NAME)]=rp.release(); + child = XMLHelper::getNextSiblingElement(child,RelyingParty); } #endif - // In process only, we need a shared lock around accessing the header clearing list. - if (!conf.isEnabled(SPConfig::OutOfProcess)) { - m_unsetLock = RWLock::create(); - } - else if (!conf.isEnabled(SPConfig::InProcess)) { + // Out of process only, we register a listener endpoint. + if (!conf.isEnabled(SPConfig::InProcess)) { ListenerService* listener = sp->getListenerService(false); if (listener) { string addr=string(getId()) + "::getHeaders::Application"; @@ -800,21 +896,27 @@ void XMLApplication::cleanup() string addr=string(getId()) + "::getHeaders::Application"; listener->unregListener(addr.c_str(),this); } - delete m_unsetLock; for_each(m_handlers.begin(),m_handlers.end(),xmltooling::cleanup()); + m_handlers.clear(); #ifndef SHIBSP_LITE - delete m_partyDefault; #ifdef HAVE_GOOD_STL for_each(m_partyMap.begin(),m_partyMap.end(),cleanup_pair()); #else for_each(m_partyMap.begin(),m_partyMap.end(),cleanup_pair()); #endif + m_partyMap.clear(); delete m_credResolver; + m_credResolver = NULL; delete m_attrResolver; + m_attrResolver = NULL; delete m_attrFilter; + m_attrFilter = NULL; delete m_attrExtractor; + m_attrExtractor = NULL; delete m_trust; + m_trust = NULL; delete m_metadata; + m_metadata = NULL; #endif } @@ -823,12 +925,14 @@ short XMLApplication::acceptNode(const DOMNode* node) const const XMLCh* name=node->getLocalName(); if (XMLString::equals(name,_Application) || XMLString::equals(name,_Audience) || + XMLString::equals(name,Notify) || + XMLString::equals(name,_Handler) || XMLString::equals(name,_AssertionConsumerService) || XMLString::equals(name,_ArtifactResolutionService) || - XMLString::equals(name,_SingleLogoutService) || + XMLString::equals(name,_LogoutInitiator) || XMLString::equals(name,_ManageNameIDService) || XMLString::equals(name,_SessionInitiator) || - XMLString::equals(name,DefaultRelyingParty) || + XMLString::equals(name,_SingleLogoutService) || XMLString::equals(name,RelyingParty) || XMLString::equals(name,_MetadataProvider) || XMLString::equals(name,_TrustEngine) || @@ -845,10 +949,8 @@ short XMLApplication::acceptNode(const DOMNode* node) const const PropertySet* XMLApplication::getRelyingParty(const EntityDescriptor* provider) const { - if (!m_partyDefault && m_base) - return m_base->getRelyingParty(provider); - else if (!provider) - return m_partyDefault; + if (!provider) + return this; #ifdef HAVE_GOOD_STL map::const_iterator i=m_partyMap.find(provider->getEntityID()); @@ -866,7 +968,7 @@ const PropertySet* XMLApplication::getRelyingParty(const EntityDescriptor* provi #else map::const_iterator i=m_partyMap.begin(); for (; i!=m_partyMap.end(); i++) { - if (XMLString::equals(i->first,provider->getId())) + if (XMLString::equals(i->first,provider->getEntityID())) return i->second; const EntitiesDescriptor* group=dynamic_cast(provider->getParent()); while (group) { @@ -876,11 +978,83 @@ const PropertySet* XMLApplication::getRelyingParty(const EntityDescriptor* provi } } #endif - return m_partyDefault; + return this; } #endif +string XMLApplication::getNotificationURL(const char* resource, bool front, unsigned int index) const +{ + const vector& locs = front ? m_frontLogout : m_backLogout; + if (locs.empty()) + return m_base ? m_base->getNotificationURL(resource, front, index) : string(); + else if (index >= locs.size()) + return string(); + +#ifdef HAVE_STRCASECMP + if (!resource || (strncasecmp(resource,"http://",7) && strncasecmp(resource,"https://",8))) +#else + if (!resource || (strnicmp(resource,"http://",7) && strnicmp(resource,"https://",8))) +#endif + throw ConfigurationException("Request URL was not absolute."); + + const char* handler=locs[index].c_str(); + + // Should never happen... + if (!handler || (*handler!='/' && strncmp(handler,"http:",5) && strncmp(handler,"https:",6))) + throw ConfigurationException( + "Invalid Location property ($1) in Notify element for Application ($2)", + params(2, handler ? handler : "null", getId()) + ); + + // The "Location" property can be in one of three formats: + // + // 1) a full URI: http://host/foo/bar + // 2) a hostless URI: http:///foo/bar + // 3) a relative path: /foo/bar + // + // # Protocol Host Path + // 1 handler handler handler + // 2 handler resource handler + // 3 resource resource handler + + const char* path = NULL; + + // Decide whether to use the handler or the resource for the "protocol" + const char* prot; + if (*handler != '/') { + prot = handler; + } + else { + prot = resource; + path = handler; + } + + // break apart the "protocol" string into protocol, host, and "the rest" + const char* colon=strchr(prot,':'); + colon += 3; + const char* slash=strchr(colon,'/'); + if (!path) + path = slash; + + // Compute the actual protocol and store. + string notifyURL(prot, colon-prot); + + // create the "host" from either the colon/slash or from the target string + // If prot == handler then we're in either #1 or #2, else #3. + // If slash == colon then we're in #2. + if (prot != handler || slash == colon) { + colon = strchr(resource, ':'); + colon += 3; // Get past the :// + slash = strchr(colon, '/'); + } + string host(colon, (slash ? slash-colon : strlen(colon))); + + // Build the URL + notifyURL += host + path; + return notifyURL; +} + const SessionInitiator* XMLApplication::getDefaultSessionInitiator() const { if (m_sessionInitDefault) return m_sessionInitDefault; @@ -929,43 +1103,15 @@ const Handler* XMLApplication::getHandler(const char* path) const return m_base ? m_base->getHandler(path) : NULL; } -void XMLApplication::clearAttributeHeaders(SPRequest& request) const +void XMLApplication::getHandlers(vector& handlers) const { - if (SPConfig::getConfig().isEnabled(SPConfig::OutOfProcess)) { - for (vector::const_iterator i = m_unsetHeaders.begin(); i!=m_unsetHeaders.end(); ++i) - request.clearHeader(i->c_str()); - return; - } - - m_unsetLock->rdlock(); - if (m_unsetHeaders.empty()) { - // No headers yet, so we have to request them from the remote half. - m_unsetLock->unlock(); - m_unsetLock->wrlock(); - if (m_unsetHeaders.empty()) { - SharedLock wrlock(m_unsetLock, false); - string addr=string(getId()) + "::getHeaders::Application"; - DDF out,in = DDF(addr.c_str()); - DDFJanitor jin(in),jout(out); - out = getServiceProvider().getListenerService()->send(in); - if (out.islist()) { - DDF header = out.first(); - while (header.isstring()) { - m_unsetHeaders.push_back(header.string()); - header = out.next(); - } - } + handlers.insert(handlers.end(), m_handlers.begin(), m_handlers.end()); + if (m_base) { + for (map::const_iterator h = m_base->m_handlerMap.begin(); h != m_base->m_handlerMap.end(); ++h) { + if (m_handlerMap.count(h->first) == 0) + handlers.push_back(h->second); } - else { - m_unsetLock->unlock(); - } - m_unsetLock->rdlock(); } - - // Now holding read lock. - SharedLock unsetLock(m_unsetLock, false); - for (vector::const_iterator i = m_unsetHeaders.begin(); i!=m_unsetHeaders.end(); ++i) - request.clearHeader(i->c_str()); } short XMLConfigImpl::acceptNode(const DOMNode* node) const @@ -976,13 +1122,12 @@ short XMLConfigImpl::acceptNode(const DOMNode* node) const if (XMLString::equals(name,Applications) || XMLString::equals(name,_ArtifactMap) || XMLString::equals(name,_Extensions) || - XMLString::equals(name,Implementation) || XMLString::equals(name,Listener) || - XMLString::equals(name,MemoryListener) || XMLString::equals(name,Policy) || XMLString::equals(name,_RequestMapper) || XMLString::equals(name,_ReplayCache) || XMLString::equals(name,_SessionCache) || + XMLString::equals(name,Site) || XMLString::equals(name,_StorageService) || XMLString::equals(name,TCPListener) || XMLString::equals(name,UnixListener)) @@ -1005,7 +1150,7 @@ void XMLConfigImpl::doExtensions(const DOMElement* e, const char* label, Categor } } catch (exception& e) { - const XMLCh* fatal=exts->getAttributeNS(NULL,fatal); + const XMLCh* fatal=exts->getAttributeNS(NULL,_fatal); if (fatal && (*fatal==chLatin_t || *fatal==chDigit_1)) { log.fatal("unable to load mandatory %s extension library %s: %s", label, path.get(), e.what()); throw; @@ -1079,30 +1224,25 @@ XMLConfigImpl::XMLConfigImpl(const DOMElement* e, bool first, const XMLConfig* o // Instantiate the ListenerService and SessionCache objects. if (conf.isEnabled(SPConfig::Listener)) { - child=XMLHelper::getFirstChildElement(SHAR,UnixListener); + child=XMLHelper::getFirstChildElement(e,UnixListener); if (child) plugtype=UNIX_LISTENER_SERVICE; else { - child=XMLHelper::getFirstChildElement(SHAR,TCPListener); + child=XMLHelper::getFirstChildElement(e,TCPListener); if (child) plugtype=TCP_LISTENER_SERVICE; else { - child=XMLHelper::getFirstChildElement(SHAR,MemoryListener); - if (child) - plugtype=MEMORY_LISTENER_SERVICE; - else { - child=XMLHelper::getFirstChildElement(SHAR,Listener); - if (child) { - auto_ptr_char type(child->getAttributeNS(NULL,_type)); - if (type.get()) - plugtype=type.get(); - } + child=XMLHelper::getFirstChildElement(e,Listener); + if (child) { + auto_ptr_char type(child->getAttributeNS(NULL,_type)); + if (type.get()) + plugtype=type.get(); } } } if (child) { log.info("building ListenerService of type %s...", plugtype.c_str()); - m_outer->m_listener = conf.ListenerServiceManager.newPlugin(plugtype.c_str(),child); + m_outer->m_listener = conf.ListenerServiceManager.newPlugin(plugtype.c_str(), child); } else { log.fatal("can't build ListenerService, missing conf:Listener element?"); @@ -1110,54 +1250,34 @@ XMLConfigImpl::XMLConfigImpl(const DOMElement* e, bool first, const XMLConfig* o } } +#ifndef SHIBSP_LITE if (m_outer->m_listener && conf.isEnabled(SPConfig::OutOfProcess) && !conf.isEnabled(SPConfig::InProcess)) { - m_outer->m_listener->regListener("set::RelayState",m_outer->m_listener); - m_outer->m_listener->regListener("get::RelayState",m_outer->m_listener); + m_outer->m_listener->regListener("set::RelayState", m_outer->m_listener); + m_outer->m_listener->regListener("get::RelayState", m_outer->m_listener); } +#endif if (conf.isEnabled(SPConfig::Caching)) { if (conf.isEnabled(SPConfig::OutOfProcess)) { #ifndef SHIBSP_LITE // First build any StorageServices. - string inmemID; - child=XMLHelper::getFirstChildElement(SHAR,_StorageService); + child=XMLHelper::getFirstChildElement(e,_StorageService); while (child) { auto_ptr_char id(child->getAttributeNS(NULL,_id)); auto_ptr_char type(child->getAttributeNS(NULL,_type)); try { log.info("building StorageService (%s) of type %s...", id.get(), type.get()); m_outer->m_storage[id.get()] = xmlConf.StorageServiceManager.newPlugin(type.get(),child); - if (!strcmp(type.get(),MEMORY_STORAGE_SERVICE)) - inmemID = id.get(); } catch (exception& ex) { log.crit("failed to instantiate StorageService (%s): %s", id.get(), ex.what()); } child=XMLHelper::getNextSiblingElement(child,_StorageService); } - - child=XMLHelper::getFirstChildElement(SHAR,_SessionCache); - if (child) { - auto_ptr_char type(child->getAttributeNS(NULL,_type)); - log.info("building SessionCache of type %s...",type.get()); - m_outer->m_sessionCache=conf.SessionCacheManager.newPlugin(type.get(),child); - } - else { - log.warn("SessionCache unspecified, building SessionCache of type %s...",STORAGESERVICE_SESSION_CACHE); - if (inmemID.empty()) { - inmemID = "memory"; - log.info("no StorageServices configured, providing in-memory version for session cache"); - m_outer->m_storage[inmemID] = xmlConf.StorageServiceManager.newPlugin(MEMORY_STORAGE_SERVICE,NULL); - } - child = e->getOwnerDocument()->createElementNS(NULL,_SessionCache); - auto_ptr_XMLCh ssid(inmemID.c_str()); - const_cast(child)->setAttributeNS(NULL,_StorageService,ssid.get()); - m_outer->m_sessionCache=conf.SessionCacheManager.newPlugin(STORAGESERVICE_SESSION_CACHE,child); - } // Replay cache. StorageService* replaySS=NULL; - child=XMLHelper::getFirstChildElement(SHAR,_ReplayCache); + child=XMLHelper::getFirstChildElement(e,_ReplayCache); if (child) { auto_ptr_char ssid(child->getAttributeNS(NULL,_StorageService)); if (ssid.get() && *ssid.get()) { @@ -1166,22 +1286,16 @@ XMLConfigImpl::XMLConfigImpl(const DOMElement* e, bool first, const XMLConfig* o if (replaySS) log.info("building ReplayCache on top of StorageService (%s)...", ssid.get()); else - log.crit("unable to locate StorageService (%s) in configuration", ssid.get()); + log.warn("unable to locate StorageService (%s) for ReplayCache, using dedicated in-memory instance", ssid.get()); } + xmlConf.setReplayCache(new ReplayCache(replaySS)); } - if (!replaySS) { - log.info("building ReplayCache using in-memory StorageService..."); - if (inmemID.empty()) { - inmemID = "memory"; - log.info("no StorageServices configured, providing in-memory version for legacy config"); - m_outer->m_storage[inmemID] = xmlConf.StorageServiceManager.newPlugin(MEMORY_STORAGE_SERVICE,NULL); - } - replaySS = m_outer->m_storage[inmemID]; + else { + log.warn("no ReplayCache built, missing conf:ReplayCache element?"); } - xmlConf.setReplayCache(new ReplayCache(replaySS)); // ArtifactMap - child=XMLHelper::getFirstChildElement(SHAR,_ArtifactMap); + child=XMLHelper::getFirstChildElement(e,_ArtifactMap); if (child) { auto_ptr_char ssid(child->getAttributeNS(NULL,_StorageService)); if (ssid.get() && *ssid.get() && m_outer->m_storage.count(ssid.get())) { @@ -1195,29 +1309,31 @@ XMLConfigImpl::XMLConfigImpl(const DOMElement* e, bool first, const XMLConfig* o } #endif } + child=XMLHelper::getFirstChildElement(e,_SessionCache); + if (child) { + auto_ptr_char type(child->getAttributeNS(NULL,_type)); + log.info("building SessionCache of type %s...",type.get()); + m_outer->m_sessionCache=conf.SessionCacheManager.newPlugin(type.get(), child); + } else { - child=XMLHelper::getFirstChildElement(SHIRE,_SessionCache); - if (child) { - auto_ptr_char type(child->getAttributeNS(NULL,_type)); - log.info("building SessionCache of type %s...",type.get()); - m_outer->m_sessionCache=conf.SessionCacheManager.newPlugin(type.get(),child); - } - else { - log.warn("SessionCache unspecified, building SessionCache of type %s...",REMOTED_SESSION_CACHE); - m_outer->m_sessionCache=conf.SessionCacheManager.newPlugin(REMOTED_SESSION_CACHE,child); - } + log.fatal("can't build SessionCache, missing conf:SessionCache element?"); + throw ConfigurationException("Can't build SessionCache, missing conf:SessionCache element?"); } } } // end of first-time-only stuff // Back to the fully dynamic stuff...next up is the RequestMapper. if (conf.isEnabled(SPConfig::RequestMapping)) { - child=XMLHelper::getFirstChildElement(SHIRE,_RequestMapper); + child=XMLHelper::getFirstChildElement(e,_RequestMapper); if (child) { auto_ptr_char type(child->getAttributeNS(NULL,_type)); log.info("building RequestMapper of type %s...",type.get()); m_requestMapper=conf.RequestMapperManager.newPlugin(type.get(),child); } + else { + log.fatal("can't build RequestMapper, missing conf:RequestMapper element?"); + throw ConfigurationException("Can't build RequestMapper, missing conf:RequestMapper element?"); + } } #ifndef SHIBSP_LITE @@ -1233,6 +1349,8 @@ XMLConfigImpl::XMLConfigImpl(const DOMElement* e, bool first, const XMLConfig* o auto_ptr settings(new DOMPropertySet()); settings->load(child, log, &filter); rules.first = settings.release(); + + // Process Rule elements. const DOMElement* rule = XMLHelper::getFirstChildElement(child,Rule); while (rule) { auto_ptr_char type(rule->getAttributeNS(NULL,_type)); @@ -1244,6 +1362,23 @@ XMLConfigImpl::XMLConfigImpl(const DOMElement* e, bool first, const XMLConfig* o } rule = XMLHelper::getNextSiblingElement(rule,Rule); } + + // Process TransportOption elements. + rule = XMLHelper::getFirstChildElement(child,TransportOption); + while (rule) { + if (rule->hasChildNodes()) { + auto_ptr_char provider(rule->getAttributeNS(NULL,_provider)); + auto_ptr_char option(rule->getAttributeNS(NULL,_option)); + auto_ptr_char value(rule->getFirstChild()->getNodeValue()); + if (provider.get() && *provider.get() && option.get() && *option.get() && value.get() && *value.get()) { + m_transportOptionMap[id.get()].push_back( + make_pair(string(provider.get()), make_pair(string(option.get()), string(value.get()))) + ); + } + } + rule = XMLHelper::getNextSiblingElement(rule,TransportOption); + } + child = XMLHelper::getNextSiblingElement(child,Policy); } } @@ -1271,34 +1406,37 @@ XMLConfigImpl::XMLConfigImpl(const DOMElement* e, bool first, const XMLConfig* o } } catch (exception&) { - this->~XMLConfigImpl(); - throw; - } -#ifndef _DEBUG - catch (...) { - this->~XMLConfigImpl(); + cleanup(); throw; } -#endif } XMLConfigImpl::~XMLConfigImpl() { + cleanup(); +} + +void XMLConfigImpl::cleanup() +{ for_each(m_appmap.begin(),m_appmap.end(),cleanup_pair()); + m_appmap.clear(); #ifndef SHIBSP_LITE for (map< string,pair > >::iterator i=m_policyMap.begin(); i!=m_policyMap.end(); ++i) { delete i->second.first; for_each(i->second.second.begin(), i->second.second.end(), xmltooling::cleanup()); } + m_policyMap.clear(); #endif delete m_requestMapper; + m_requestMapper = NULL; if (m_document) m_document->release(); + m_document = NULL; } +#ifndef SHIBSP_LITE void XMLConfig::receive(DDF& in, ostream& out) { -#ifndef SHIBSP_LITE if (!strcmp(in.name(), "get::RelayState")) { const char* id = in["id"].string(); const char* key = in["key"].string(); @@ -1348,8 +1486,8 @@ void XMLConfig::receive(DDF& in, ostream& out) DDFJanitor jret(ret); out << ret; } -#endif } +#endif pair XMLConfig::load() {