Added (hopefully) simultaneous 1.0/1.1 support.

git-svn-id: https://svn.middleware.georgetown.edu/cpp-sp/trunk@1606 cb58f699-b61c-0410-a6fe-9272a202ed29

diff --git a/shib-target/ArtifactMapper.cpp b/shib-target/ArtifactMapper.cpp
index a60ffc2..9efae08 100644 (file)
--- a/shib-target/ArtifactMapper.cpp
+++ b/shib-target/ArtifactMapper.cpp
@@ -63,7 +63,7 @@ using namespace saml;
 using namespace shibboleth;
 using namespace shibtarget;
 
-SAMLBrowserProfile::ArtifactMapper::ArtifactMapperResponse STArtifactMapper::map(const SAMLArtifact* artifact)
+SAMLBrowserProfile::ArtifactMapper::ArtifactMapperResponse STArtifactMapper::map(const SAMLArtifact* artifact, int minorVersion)
 {
     Category& log=Category::getInstance("shibtarget.ArtifactMapper");
     
@@ -87,25 +87,10 @@ SAMLBrowserProfile::ArtifactMapper::ArtifactMapperResponse STArtifactMapper::map
     // Depends on type of artifact.
     const SAMLArtifactType0001* type1=dynamic_cast<const SAMLArtifactType0001*>(artifact);
     if (type1) {
-        // With type 01, any endpoint will do. Try SAML 1.1 first.
-        const IIDPSSODescriptor* idp=entity->getIDPSSODescriptor(saml::XML::SAML11_PROTOCOL_ENUM);
-        if (idp) {
-            const IEndpointManager* mgr=idp->getArtifactResolutionServiceManager();
-            Iterator<const IEndpoint*> eps=mgr ? mgr->getEndpoints() : EMPTY(const IEndpoint*);
-            while (eps.hasNext()) {
-                const IEndpoint* ep=eps.next();
-                amr.binding = m_app->getBinding(ep->getBinding());
-                if (amr.binding) {
-                    auto_ptr_char loc(ep->getLocation());
-                    amr.endpoint = loc.get();
-                    amr.callCtx = new ShibHTTPHook::ShibHTTPHookCallContext(credUse ? credUse->getString("TLS").second : NULL,idp);
-                    return amr;
-                }
-            }
-        }
-        
-        // No compatible 1.1 binding, try 1.0...
-        idp=entity->getIDPSSODescriptor(saml::XML::SAML10_PROTOCOL_ENUM);
+        // With type 01, any endpoint will do.
+        const IIDPSSODescriptor* idp=entity->getIDPSSODescriptor(
+            minorVersion==1 ? saml::XML::SAML11_PROTOCOL_ENUM : saml::XML::SAML10_PROTOCOL_ENUM
+            );
         if (idp) {
             const IEndpointManager* mgr=idp->getArtifactResolutionServiceManager();
             Iterator<const IEndpoint*> eps=mgr ? mgr->getEndpoints() : EMPTY(const IEndpoint*);
@@ -124,27 +109,10 @@ SAMLBrowserProfile::ArtifactMapper::ArtifactMapperResponse STArtifactMapper::map
     else {
         const SAMLArtifactType0002* type2=dynamic_cast<const SAMLArtifactType0002*>(artifact);
         if (type2) {
-            // With type 02, we have to find the matching location. Try SAML 1.1 first.
-            const IIDPSSODescriptor* idp=entity->getIDPSSODescriptor(saml::XML::SAML11_PROTOCOL_ENUM);
-            if (idp) {
-                const IEndpointManager* mgr=idp->getArtifactResolutionServiceManager();
-                Iterator<const IEndpoint*> eps=mgr ? mgr->getEndpoints() : EMPTY(const IEndpoint*);
-                while (eps.hasNext()) {
-                    const IEndpoint* ep=eps.next();
-                    auto_ptr_char loc(ep->getLocation());
-                    if (!strcmp(loc.get(),type2->getSourceLocation())) {
-                        amr.binding = m_app->getBinding(ep->getBinding());
-                        if (amr.binding) {
-                            amr.endpoint = loc.get();
-                            amr.callCtx = new ShibHTTPHook::ShibHTTPHookCallContext(credUse ? credUse->getString("TLS").second : NULL,idp);
-                            return amr;
-                        }
-                    }
-                }
-            }
-
-            // No match for 1.1, try 1.0...
-            idp=entity->getIDPSSODescriptor(saml::XML::SAML10_PROTOCOL_ENUM);
+            // With type 02, we have to find the matching location.
+            const IIDPSSODescriptor* idp=entity->getIDPSSODescriptor(
+                minorVersion==1 ? saml::XML::SAML11_PROTOCOL_ENUM : saml::XML::SAML10_PROTOCOL_ENUM
+                );
             if (idp) {
                 const IEndpointManager* mgr=idp->getArtifactResolutionServiceManager();
                 Iterator<const IEndpoint*> eps=mgr ? mgr->getEndpoints() : EMPTY(const IEndpoint*);

diff --git a/shib-target/internal.h b/shib-target/internal.h
index 058699f..3239879 100644 (file)
--- a/shib-target/internal.h
+++ b/shib-target/internal.h
@@ -129,20 +129,6 @@ namespace shibtarget {
         mutable RPCHandlePool* m_rpcpool;
     };
 
-    // Helper class for SAML 2.0 Common Domain Cookie operations
-    class CommonDomainCookie
-    {
-    public:
-        CommonDomainCookie(const char* cookie);
-        ~CommonDomainCookie() {}
-        saml::Iterator<std::string> get() {return m_list;}
-        const char* set(const char* providerId);
-        static const char CDCName[];
-    private:
-        std::string m_encoded;
-        std::vector<std::string> m_list;
-    };
-
     // Generic class, which handles the IPropertySet configuration interface.
     // Most of the basic configuration details are exposed via this interface.
     // This implementation extracts the XML tree structure and caches it in a map
@@ -187,7 +173,8 @@ namespace shibtarget {
             : m_app(application), m_localcopy(application->getMetadataProviders()), m_metadata(m_localcopy), m_ctx(NULL) {}
         virtual ~STArtifactMapper() {delete m_ctx;}
     
-        saml::SAMLBrowserProfile::ArtifactMapper::ArtifactMapperResponse map(const saml::SAMLArtifact* artifact);
+        saml::SAMLBrowserProfile::ArtifactMapper::ArtifactMapperResponse
+            map(const saml::SAMLArtifact* artifact, int minorVersion);
     
     private:
         const IApplication* m_app;

diff --git a/shib-target/shib-ccache.cpp b/shib-target/shib-ccache.cpp
index d700e0a..2d3ea73 100644 (file)
--- a/shib-target/shib-ccache.cpp
+++ b/shib-target/shib-ccache.cpp
@@ -709,11 +709,16 @@ pair<SAMLResponse*,SAMLResponse*> InternalCCacheEntry::getNewResponse()
     }
 
     // Try to locate an AA role.
+    int minorVersion=1;
     const IAttributeAuthorityDescriptor* AA=site->getAttributeAuthorityDescriptor(saml::XML::SAML11_PROTOCOL_ENUM);
     if (!AA) {
-        log->error("unable to locate metadata for identity provider's Attribute Authority");
-        MetadataException ex("Unable to locate metadata for identity provider's Attribute Authority.");
-        annotateException(&ex,site);
+        AA=site->getAttributeAuthorityDescriptor(saml::XML::SAML10_PROTOCOL_ENUM);
+        if (!AA) {
+            log->error("unable to locate metadata for identity provider's Attribute Authority");
+            MetadataException ex("Unable to locate metadata for identity provider's Attribute Authority.");
+            annotateException(&ex,site);
+        }
+        minorVersion=0;
     }
 
     // Get protocol signing policy.
@@ -731,6 +736,7 @@ pair<SAMLResponse*,SAMLResponse*> InternalCCacheEntry::getNewResponse()
             application->getAttributeDesignators().clone()
             );
         auto_ptr<SAMLRequest> req(new SAMLRequest(q));
+        req->setMinorVersion(minorVersion);
         
         // Sign it? Highly doubtful we'll ever use this, but just for fun...
         if (signRequest.first && signRequest.second && signingCred.first) {

diff --git a/shib-target/shib-handlers.cpp b/shib-target/shib-handlers.cpp
index 6c4627c..0af26a5 100644 (file)
--- a/shib-target/shib-handlers.cpp
+++ b/shib-target/shib-handlers.cpp
@@ -94,6 +94,20 @@ namespace {
     map<string,char*> kvp_map;
   };
 
+    // Helper class for SAML 2.0 Common Domain Cookie operations
+    class CommonDomainCookie
+    {
+    public:
+        CommonDomainCookie(const char* cookie);
+        ~CommonDomainCookie() {}
+        saml::Iterator<std::string> get() {return m_list;}
+        const char* set(const char* providerId);
+        static const char CDCName[];
+    private:
+        std::string m_encoded;
+        std::vector<std::string> m_list;
+    };
+
   class SessionInitiator : virtual public IHandler
   {
   public:

diff --git a/shib-target/shibtarget.dsp b/shib-target/shibtarget.dsp
index 3b50ea8..74d80cb 100644 (file)
--- a/shib-target/shibtarget.dsp
+++ b/shib-target/shibtarget.dsp
@@ -123,6 +123,10 @@ SOURCE=".\shib-config.cpp"
 # End Source File
 # Begin Source File
 
+SOURCE=".\shib-handlers.cpp"
+# End Source File
+# Begin Source File
+
 SOURCE=".\shib-ini.cpp"
 # End Source File
 # Begin Source File

diff --git a/shib/ShibBrowserProfile.cpp b/shib/ShibBrowserProfile.cpp
index a8f72a1..d95f2a2 100644 (file)
--- a/shib/ShibBrowserProfile.cpp
+++ b/shib/ShibBrowserProfile.cpp
@@ -77,17 +77,13 @@ ShibBrowserProfile::~ShibBrowserProfile()
     delete m_profile;
 }
 
-void ShibBrowserProfile::setVersion(int major, int minor)
-{
-    m_profile->setVersion(major,minor);
-}
-
 SAMLBrowserProfile::BrowserProfileResponse ShibBrowserProfile::receive(
     const char* packet,
     const XMLCh* recipient,
     int supportedProfiles,
     IReplayCache* replayCache,
-    SAMLBrowserProfile::ArtifactMapper* callback
+    SAMLBrowserProfile::ArtifactMapper* callback,
+    int minorVersion
     ) const
 {
 #ifdef _DEBUG
@@ -100,7 +96,7 @@ SAMLBrowserProfile::BrowserProfileResponse ShibBrowserProfile::receive(
     // as an exception.
     SAMLBrowserProfile::BrowserProfileResponse bpr;
     try {
-        bpr=m_profile->receive(packet, recipient, supportedProfiles, replayCache, callback);
+        bpr=m_profile->receive(packet, recipient, supportedProfiles, replayCache, callback, minorVersion);
     }
     catch (SAMLException& e) {
         // Try our best to attach additional information.
@@ -108,7 +104,9 @@ SAMLBrowserProfile::BrowserProfileResponse ShibBrowserProfile::receive(
             Metadata m(m_metadatas);
             const IEntityDescriptor* provider=m.lookup(e.getProperty("issuer"),false);
             if (provider) {
-                const IIDPSSODescriptor* role=provider->getIDPSSODescriptor(saml::XML::SAML11_PROTOCOL_ENUM);
+                const IIDPSSODescriptor* role=provider->getIDPSSODescriptor(
+                    minorVersion==1 ? saml::XML::SAML11_PROTOCOL_ENUM : saml::XML::SAML10_PROTOCOL_ENUM
+                    );
                 if (role) annotateException(&e,role); // throws it
                 annotateException(&e,provider);  // throws it
             }
@@ -148,7 +146,9 @@ SAMLBrowserProfile::BrowserProfileResponse ShibBrowserProfile::receive(
     }
 
     // Is this provider an IdP?
-    const IIDPSSODescriptor* role=provider->getIDPSSODescriptor(saml::XML::SAML11_PROTOCOL_ENUM);
+    const IIDPSSODescriptor* role=provider->getIDPSSODescriptor(
+        minorVersion==1 ? saml::XML::SAML11_PROTOCOL_ENUM : saml::XML::SAML10_PROTOCOL_ENUM
+        );
     if (role) {
         // Use this role to evaluate the signature(s). If the response is unsigned, we know
         // it was an artifact profile run.
@@ -175,8 +175,8 @@ SAMLBrowserProfile::BrowserProfileResponse ShibBrowserProfile::receive(
 
     auto_ptr_char issuer(bpr.assertion->getIssuer());
     auto_ptr_char nq(bpr.authnStatement->getSubject()->getNameIdentifier()->getNameQualifier());
-    log.error("metadata for assertion issuer indicates no SAML 1.x identity provider role (Issuer='%s', NameQualifier='%s'",
-        issuer.get(), (nq.get() ? nq.get() : "none"));
+    log.error("metadata for assertion issuer indicates no SAML 1.%d identity provider role (Issuer='%s', NameQualifier='%s'",
+        minorVersion, issuer.get(), (nq.get() ? nq.get() : "none"));
     bpr.clear();
     MetadataException ex("metadata lookup failed, issuer not registered as SAML 1.x identity provider");
     annotateException(&ex,provider,false);

diff --git a/shib/shib.h b/shib/shib.h
index eceb96e..053d5f6 100644 (file)
--- a/shib/shib.h
+++ b/shib/shib.h
@@ -487,13 +487,13 @@ namespace shibboleth
             );
         virtual ~ShibBrowserProfile();
 
-        virtual void setVersion(int major, int minor);
         virtual saml::SAMLBrowserProfile::BrowserProfileResponse receive(
             const char* packet,
             const XMLCh* recipient,
             int supportedProfiles,
             saml::IReplayCache* replayCache=NULL,
-            saml::SAMLBrowserProfile::ArtifactMapper* callback=NULL
+            saml::SAMLBrowserProfile::ArtifactMapper* callback=NULL,
+            int minorVersion=1
             ) const;
 
     private: